Merge branch 'for-4.5/block-dax' into for-4.5/libnvdimm

author: Dan Williams <dan.j.williams@intel.com> 2016-01-10 10:53:55 -0500
committer: Dan Williams <dan.j.williams@intel.com> 2016-01-10 10:53:55 -0500
commit: 8b63b6bfc1a551acf154061699028c7032d7890c (patch)
tree: 16882e9bc9e35eacb870a6d8a71617e579c4ffdc
parent: e07ecd76d4db7bda1e9495395b2110a3fe28845a (diff)
parent: 55f5560d8c18fe33fc169f8d244a9247dcac7612 (diff)
290 files changed, 3172 insertions, 1946 deletions
diff --git a/Documentation/devicetree/bindings/gpio/gpio-mpc8xxx.txt b/Documentation/devicetree/bindings/gpio/gpio-mpc8xxx.txt
index f2455c50533d..120bc4971cf3 100644
--- a/Documentation/devicetree/bindings/gpio/gpio-mpc8xxx.txt
+++ b/Documentation/devicetree/bindings/gpio/gpio-mpc8xxx.txt
@@ -11,6 +11,10 @@ Required properties:
      0 = active high
      1 = active low
+Optional properties:
+- little-endian : GPIO registers are used as little endian. If not
+                  present registers are used as big endian by default.
 Example:
 gpio0: gpio@1100 {
diff --git a/MAINTAINERS b/MAINTAINERS
index 69c8a9c3289a..9bff63cf326e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2975,6 +2975,7 @@ F:	kernel/cpuset.c
 CONTROL GROUP - MEMORY RESOURCE CONTROLLER (MEMCG)
 M:      Johannes Weiner <hannes@cmpxchg.org>
 M:      Michal Hocko <mhocko@kernel.org>
+M:      Vladimir Davydov <vdavydov@virtuozzo.com>
 L:      cgroups@vger.kernel.org
 L:      linux-mm@kvack.org
 S:      Maintained
@@ -8286,7 +8287,7 @@ F:	include/linux/delayacct.h
 F:      kernel/delayacct.c
 PERFORMANCE EVENTS SUBSYSTEM
-M:      Peter Zijlstra <a.p.zijlstra@chello.nl>
+M:      Peter Zijlstra <peterz@infradead.org>
 M:      Ingo Molnar <mingo@redhat.com>
 M:      Arnaldo Carvalho de Melo <acme@kernel.org>
 L:      linux-kernel@vger.kernel.org
diff --git a/Makefile b/Makefile
index d644f6e92cf6..bc0165d0f5cf 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 4
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 NAME = Blurry Fish Butt
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 34e1569a11ee..b8a47974c2d7 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -2,6 +2,7 @@ config ARM
        bool
        default y
        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
+        select ARCH_HAS_DEVMEM_IS_ALLOWED
        select ARCH_HAS_ELF_RANDOMIZE
        select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
        select ARCH_HAVE_CUSTOM_GPIO_H
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index 259c0ca9c99a..e356357d86bb 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -15,20 +15,6 @@ config ARM_PTDUMP
          kernel.
          If in doubt, say "N"
-config STRICT_DEVMEM
-        bool "Filter access to /dev/mem"
-        depends on MMU
-        ---help---
-          If this option is disabled, you allow userspace (root) access to all
-          of memory, including kernel and userspace memory. Accidental
-          access to this is obviously disastrous, but specific access can
-          be used by people debugging the kernel.
-          If this option is switched on, the /dev/mem file only allows
-          userspace access to memory mapped peripherals.
-          If in doubt, say Y.
 # RMK wants arm kernels compiled with frame pointers or stack unwinding.
 # If you know what you are doing and are willing to live without stack
 # traces, you can get a slightly smaller kernel by setting this option to
diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
index d83ff9c9701e..de8791a4d131 100644
--- a/arch/arm/boot/dts/am4372.dtsi
+++ b/arch/arm/boot/dts/am4372.dtsi
@@ -74,7 +74,7 @@
                reg = <0x48240200 0x100>;
                interrupts = <GIC_PPI 11 IRQ_TYPE_LEVEL_HIGH>;
                interrupt-parent = <&gic>;
-                clocks = <&dpll_mpu_m2_ck>;
+                clocks = <&mpu_periphclk>;
        };
        local_timer: timer@48240600 {
@@ -82,7 +82,7 @@
                reg = <0x48240600 0x100>;
                interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_HIGH>;
                interrupt-parent = <&gic>;
-                clocks = <&dpll_mpu_m2_ck>;
+                clocks = <&mpu_periphclk>;
        };
        l2-cache-controller@48242000 {
diff --git a/arch/arm/boot/dts/am43xx-clocks.dtsi b/arch/arm/boot/dts/am43xx-clocks.dtsi
index cc88728d751d..a38af2bfbfcf 100644
--- a/arch/arm/boot/dts/am43xx-clocks.dtsi
+++ b/arch/arm/boot/dts/am43xx-clocks.dtsi
@@ -259,6 +259,14 @@
                ti,invert-autoidle-bit;
        };
+        mpu_periphclk: mpu_periphclk {
+                #clock-cells = <0>;
+                compatible = "fixed-factor-clock";
+                clocks = <&dpll_mpu_m2_ck>;
+                clock-mult = <1>;
+                clock-div = <2>;
+        };
        dpll_ddr_ck: dpll_ddr_ck {
                #clock-cells = <0>;
                compatible = "ti,am3-dpll-clock";
diff --git a/arch/arm/boot/dts/at91-sama5d2_xplained.dts b/arch/arm/boot/dts/at91-sama5d2_xplained.dts
index ad6de73ed5a5..e74df327cdd3 100644
--- a/arch/arm/boot/dts/at91-sama5d2_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d2_xplained.dts
@@ -184,6 +184,7 @@
                                                        regulator-name = "VDD_SDHC_1V8";
                                                        regulator-min-microvolt = <1800000>;
                                                        regulator-max-microvolt = <1800000>;
+                                                        regulator-always-on;
                                                };
                                        };
                                };
diff --git a/arch/arm/boot/dts/berlin2q.dtsi b/arch/arm/boot/dts/berlin2q.dtsi
index 8ea177f375dd..fb1da99996ea 100644
--- a/arch/arm/boot/dts/berlin2q.dtsi
+++ b/arch/arm/boot/dts/berlin2q.dtsi
@@ -118,7 +118,8 @@
                sdhci0: sdhci@ab0000 {
                        compatible = "mrvl,pxav3-mmc";
                        reg = <0xab0000 0x200>;
-                        clocks = <&chip_clk CLKID_SDIO1XIN>;
+                        clocks = <&chip_clk CLKID_SDIO1XIN>, <&chip_clk CLKID_SDIO>;
+                        clock-names = "io", "core";
                        interrupts = <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>;
                        status = "disabled";
                };
@@ -126,7 +127,8 @@
                sdhci1: sdhci@ab0800 {
                        compatible = "mrvl,pxav3-mmc";
                        reg = <0xab0800 0x200>;
-                        clocks = <&chip_clk CLKID_SDIO1XIN>;
+                        clocks = <&chip_clk CLKID_SDIO1XIN>, <&chip_clk CLKID_SDIO>;
+                        clock-names = "io", "core";
                        interrupts = <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>;
                        status = "disabled";
                };
@@ -135,7 +137,7 @@
                        compatible = "mrvl,pxav3-mmc";
                        reg = <0xab1000 0x200>;
                        interrupts = <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>;
-                        clocks = <&chip_clk CLKID_NFC_ECC>, <&chip_clk CLKID_NFC>;
+                        clocks = <&chip_clk CLKID_NFC_ECC>, <&chip_clk CLKID_SDIO>;
                        clock-names = "io", "core";
                        status = "disabled";
                };
diff --git a/arch/arm/boot/dts/dm816x.dtsi b/arch/arm/boot/dts/dm816x.dtsi
index 3c99cfa1a876..eee636de4cd8 100644
--- a/arch/arm/boot/dts/dm816x.dtsi
+++ b/arch/arm/boot/dts/dm816x.dtsi
@@ -218,6 +218,7 @@
                        reg = <0x480c8000 0x2000>;
                        interrupts = <77>;
                        ti,hwmods = "mailbox";
+                        #mbox-cells = <1>;
                        ti,mbox-num-users = <4>;
                        ti,mbox-num-fifos = <12>;
                        mbox_dsp: mbox_dsp {
@@ -279,8 +280,11 @@
                        ti,spi-num-cs = <4>;
                        ti,hwmods = "mcspi1";
                        dmas = <&edma 16 &edma 17
-                                &edma 18 &edma 19>;
+                                &edma 18 &edma 19
-                        dma-names = "tx0", "rx0", "tx1", "rx1";
+                                &edma 20 &edma 21
+                                &edma 22 &edma 23>;
+                        dma-names = "tx0", "rx0", "tx1", "rx1",
+                                    "tx2", "rx2", "tx3", "rx3";
                };
                mmc1: mmc@48060000 {
diff --git a/arch/arm/boot/dts/vf610-colibri.dtsi b/arch/arm/boot/dts/vf610-colibri.dtsi
index 19fe045b8334..2d7eab755210 100644
--- a/arch/arm/boot/dts/vf610-colibri.dtsi
+++ b/arch/arm/boot/dts/vf610-colibri.dtsi
@@ -18,8 +18,3 @@
                reg = <0x80000000 0x10000000>;
        };
 };
-&L2 {
-        arm,data-latency = <2 1 2>;
-        arm,tag-latency = <3 2 3>;
-};
diff --git a/arch/arm/boot/dts/vf610.dtsi b/arch/arm/boot/dts/vf610.dtsi
index 5f8eb1bd782b..58bc6e448be5 100644
--- a/arch/arm/boot/dts/vf610.dtsi
+++ b/arch/arm/boot/dts/vf610.dtsi
@@ -19,7 +19,7 @@
                reg = <0x40006000 0x1000>;
                cache-unified;
                cache-level = <2>;
-                arm,data-latency = <1 1 1>;
+                arm,data-latency = <3 3 3>;
                arm,tag-latency = <2 2 2>;
        };
 };
diff --git a/arch/arm/boot/dts/vfxxx.dtsi b/arch/arm/boot/dts/vfxxx.dtsi
index 0d5acc2cdc8e..3cd1b27f2697 100644
--- a/arch/arm/boot/dts/vfxxx.dtsi
+++ b/arch/arm/boot/dts/vfxxx.dtsi
@@ -178,8 +178,10 @@
                                compatible = "fsl,vf610-sai";
                                reg = <0x40031000 0x1000>;
                                interrupts = <86 IRQ_TYPE_LEVEL_HIGH>;
-                                clocks = <&clks VF610_CLK_SAI2>;
+                                clocks = <&clks VF610_CLK_SAI2>,
-                                clock-names = "sai";
+                                        <&clks VF610_CLK_SAI2_DIV>,
+                                        <&clks 0>, <&clks 0>;
+                                clock-names = "bus", "mclk1", "mclk2", "mclk3";
                                dma-names = "tx", "rx";
                                dmas = <&edma0 0 21>,
                                        <&edma0 0 20>;
diff --git a/arch/arm/include/asm/arch_gicv3.h b/arch/arm/include/asm/arch_gicv3.h
index 6607d976e07d..7da5503c0591 100644
--- a/arch/arm/include/asm/arch_gicv3.h
+++ b/arch/arm/include/asm/arch_gicv3.h
@@ -21,6 +21,7 @@
 #ifndef __ASSEMBLY__
 #include <linux/io.h>
+#include <asm/barrier.h>
 #define __ACCESS_CP15(CRn, Op1, CRm, Op2)       p15, Op1, %0, CRn, CRm, Op2
 #define __ACCESS_CP15_64(Op1, CRm)              p15, Op1, %Q0, %R0, CRm
diff --git a/arch/arm/mach-at91/Kconfig b/arch/arm/mach-at91/Kconfig
index 92673006e55c..28656c2b54a0 100644
--- a/arch/arm/mach-at91/Kconfig
+++ b/arch/arm/mach-at91/Kconfig
@@ -4,7 +4,6 @@ menuconfig ARCH_AT91
        select ARCH_REQUIRE_GPIOLIB
        select COMMON_CLK_AT91
        select PINCTRL
-        select PINCTRL_AT91
        select SOC_BUS
 if ARCH_AT91
@@ -17,6 +16,7 @@ config SOC_SAMA5D2
        select HAVE_AT91_USB_CLK
        select HAVE_AT91_H32MX
        select HAVE_AT91_GENERATED_CLK
+        select PINCTRL_AT91PIO4
        help
          Select this if ou are using one of Atmel's SAMA5D2 family SoC.
@@ -27,6 +27,7 @@ config SOC_SAMA5D3
        select HAVE_AT91_UTMI
        select HAVE_AT91_SMD
        select HAVE_AT91_USB_CLK
+        select PINCTRL_AT91
        help
          Select this if you are using one of Atmel's SAMA5D3 family SoC.
          This support covers SAMA5D31, SAMA5D33, SAMA5D34, SAMA5D35, SAMA5D36.
@@ -40,6 +41,7 @@ config SOC_SAMA5D4
        select HAVE_AT91_SMD
        select HAVE_AT91_USB_CLK
        select HAVE_AT91_H32MX
+        select PINCTRL_AT91
        help
          Select this if you are using one of Atmel's SAMA5D4 family SoC.
@@ -50,6 +52,7 @@ config SOC_AT91RM9200
        select CPU_ARM920T
        select HAVE_AT91_USB_CLK
        select MIGHT_HAVE_PCI
+        select PINCTRL_AT91
        select SOC_SAM_V4_V5
        select SRAM if PM
        help
@@ -65,6 +68,7 @@ config SOC_AT91SAM9
        select HAVE_AT91_UTMI
        select HAVE_FB_ATMEL
        select MEMORY
+        select PINCTRL_AT91
        select SOC_SAM_V4_V5
        select SRAM if PM
        help
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 80e277cfcc8b..23726fb31741 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -41,8 +41,10 @@
 * implementation should be moved down into the pinctrl driver and get
 * called as part of the generic suspend/resume path.
 */
+#ifdef CONFIG_PINCTRL_AT91
 extern void at91_pinctrl_gpio_suspend(void);
 extern void at91_pinctrl_gpio_resume(void);
+#endif
 static struct {
        unsigned long uhp_udp_mask;
@@ -151,8 +153,9 @@ static void at91_pm_suspend(suspend_state_t state)
 static int at91_pm_enter(suspend_state_t state)
 {
+#ifdef CONFIG_PINCTRL_AT91
        at91_pinctrl_gpio_suspend();
+#endif
        switch (state) {
        /*
         * Suspend-to-RAM is like STANDBY plus slow clock mode, so
@@ -192,7 +195,9 @@ static int at91_pm_enter(suspend_state_t state)
 error:
        target_state = PM_SUSPEND_ON;
+#ifdef CONFIG_PINCTRL_AT91
        at91_pinctrl_gpio_resume();
+#endif
        return 0;
 }
diff --git a/arch/arm/mach-exynos/pmu.c b/arch/arm/mach-exynos/pmu.c
index de68938ee6aa..c21e41dad19c 100644
--- a/arch/arm/mach-exynos/pmu.c
+++ b/arch/arm/mach-exynos/pmu.c
@@ -748,8 +748,12 @@ static void exynos5_powerdown_conf(enum sys_powerdown mode)
 void exynos_sys_powerdown_conf(enum sys_powerdown mode)
 {
        unsigned int i;
+        const struct exynos_pmu_data *pmu_data;
+        if (!pmu_context)
+                return;
-        const struct exynos_pmu_data *pmu_data = pmu_context->pmu_data;
+        pmu_data = pmu_context->pmu_data;
        if (pmu_data->powerdown_conf)
                pmu_data->powerdown_conf(mode);
diff --git a/arch/arm/mach-ixp4xx/include/mach/io.h b/arch/arm/mach-ixp4xx/include/mach/io.h
index b02439019963..7a0c13bf4269 100644
--- a/arch/arm/mach-ixp4xx/include/mach/io.h
+++ b/arch/arm/mach-ixp4xx/include/mach/io.h
@@ -143,7 +143,7 @@ static inline void __indirect_writesl(volatile void __iomem *bus_addr,
                writel(*vaddr++, bus_addr);
 }
-static inline unsigned char __indirect_readb(const volatile void __iomem *p)
+static inline u8 __indirect_readb(const volatile void __iomem *p)
 {
        u32 addr = (u32)p;
        u32 n, byte_enables, data;
@@ -166,7 +166,7 @@ static inline void __indirect_readsb(const volatile void __iomem *bus_addr,
                *vaddr++ = readb(bus_addr);
 }
-static inline unsigned short __indirect_readw(const volatile void __iomem *p)
+static inline u16 __indirect_readw(const volatile void __iomem *p)
 {
        u32 addr = (u32)p;
        u32 n, byte_enables, data;
@@ -189,7 +189,7 @@ static inline void __indirect_readsw(const volatile void __iomem *bus_addr,
                *vaddr++ = readw(bus_addr);
 }
-static inline unsigned long __indirect_readl(const volatile void __iomem *p)
+static inline u32 __indirect_readl(const volatile void __iomem *p)
 {
        u32 addr = (__force u32)p;
        u32 data;
@@ -350,7 +350,7 @@ static inline void insl(u32 io_addr, void *p, u32 count)
                                        ((unsigned long)p <= (PIO_MASK + PIO_OFFSET)))
 #define ioread8(p)                      ioread8(p)
-static inline unsigned int ioread8(const void __iomem *addr)
+static inline u8 ioread8(const void __iomem *addr)
 {
        unsigned long port = (unsigned long __force)addr;
        if (__is_io_address(port))
@@ -378,7 +378,7 @@ static inline void ioread8_rep(const void __iomem *addr, void *vaddr, u32 count)
 }
 #define ioread16(p)                     ioread16(p)
-static inline unsigned int ioread16(const void __iomem *addr)
+static inline u16 ioread16(const void __iomem *addr)
 {
        unsigned long port = (unsigned long __force)addr;
        if (__is_io_address(port))
@@ -407,7 +407,7 @@ static inline void ioread16_rep(const void __iomem *addr, void *vaddr,
 }
 #define ioread32(p)                     ioread32(p)
-static inline unsigned int ioread32(const void __iomem *addr)
+static inline u32 ioread32(const void __iomem *addr)
 {
        unsigned long port = (unsigned long __force)addr;
        if (__is_io_address(port))
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 5076d3f334d2..4b4371db5799 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -121,6 +121,7 @@ config ARCH_OMAP2PLUS_TYPICAL
        select NEON if CPU_V7
        select PM
        select REGULATOR
+        select REGULATOR_FIXED_VOLTAGE
        select TWL4030_CORE if ARCH_OMAP3 || ARCH_OMAP4
        select TWL4030_POWER if ARCH_OMAP3 || ARCH_OMAP4
        select VFP
@@ -201,7 +202,6 @@ config MACH_OMAP3_PANDORA
        depends on ARCH_OMAP3
        default y
        select OMAP_PACKAGE_CBB
-        select REGULATOR_FIXED_VOLTAGE if REGULATOR
 config MACH_NOKIA_N810
       bool
diff --git a/arch/arm/mach-pxa/ezx.c b/arch/arm/mach-pxa/ezx.c
index 9a9c15bfcd34..7c0d5618be5e 100644
--- a/arch/arm/mach-pxa/ezx.c
+++ b/arch/arm/mach-pxa/ezx.c
@@ -889,6 +889,7 @@ static void __init e680_init(void)
        pxa_set_keypad_info(&e680_keypad_platform_data);
+        pwm_add_table(ezx_pwm_lookup, ARRAY_SIZE(ezx_pwm_lookup));
        platform_add_devices(ARRAY_AND_SIZE(ezx_devices));
        platform_add_devices(ARRAY_AND_SIZE(e680_devices));
 }
@@ -956,6 +957,7 @@ static void __init a1200_init(void)
        pxa_set_keypad_info(&a1200_keypad_platform_data);
+        pwm_add_table(ezx_pwm_lookup, ARRAY_SIZE(ezx_pwm_lookup));
        platform_add_devices(ARRAY_AND_SIZE(ezx_devices));
        platform_add_devices(ARRAY_AND_SIZE(a1200_devices));
 }
@@ -1148,6 +1150,7 @@ static void __init a910_init(void)
                platform_device_register(&a910_camera);
        }
+        pwm_add_table(ezx_pwm_lookup, ARRAY_SIZE(ezx_pwm_lookup));
        platform_add_devices(ARRAY_AND_SIZE(ezx_devices));
        platform_add_devices(ARRAY_AND_SIZE(a910_devices));
 }
@@ -1215,6 +1218,7 @@ static void __init e6_init(void)
        pxa_set_keypad_info(&e6_keypad_platform_data);
+        pwm_add_table(ezx_pwm_lookup, ARRAY_SIZE(ezx_pwm_lookup));
        platform_add_devices(ARRAY_AND_SIZE(ezx_devices));
        platform_add_devices(ARRAY_AND_SIZE(e6_devices));
 }
@@ -1256,6 +1260,7 @@ static void __init e2_init(void)
        pxa_set_keypad_info(&e2_keypad_platform_data);
+        pwm_add_table(ezx_pwm_lookup, ARRAY_SIZE(ezx_pwm_lookup));
        platform_add_devices(ARRAY_AND_SIZE(ezx_devices));
        platform_add_devices(ARRAY_AND_SIZE(e2_devices));
 }
diff --git a/arch/arm/mach-s3c24xx/pll-s3c2440-12000000.c b/arch/arm/mach-s3c24xx/pll-s3c2440-12000000.c
index a19460e6e7b0..b355fca6cc2e 100644
--- a/arch/arm/mach-s3c24xx/pll-s3c2440-12000000.c
+++ b/arch/arm/mach-s3c24xx/pll-s3c2440-12000000.c
@@ -20,7 +20,7 @@
 #include <plat/cpu.h>
 #include <plat/cpu-freq-core.h>
-static struct cpufreq_frequency_table s3c2440_plls_12[] __initdata = {
+static struct cpufreq_frequency_table s3c2440_plls_12[] = {
        { .frequency = 75000000,        .driver_data = PLLVAL(0x75, 3, 3),  },  /* FVco 600.000000 */
        { .frequency = 80000000,        .driver_data = PLLVAL(0x98, 4, 3),  },  /* FVco 640.000000 */
        { .frequency = 90000000,        .driver_data = PLLVAL(0x70, 2, 3),  },  /* FVco 720.000000 */
diff --git a/arch/arm/mach-s3c24xx/pll-s3c2440-16934400.c b/arch/arm/mach-s3c24xx/pll-s3c2440-16934400.c
index 1191b2905625..be9a248b5ce9 100644
--- a/arch/arm/mach-s3c24xx/pll-s3c2440-16934400.c
+++ b/arch/arm/mach-s3c24xx/pll-s3c2440-16934400.c
@@ -20,7 +20,7 @@
 #include <plat/cpu.h>
 #include <plat/cpu-freq-core.h>
-static struct cpufreq_frequency_table s3c2440_plls_169344[] __initdata = {
+static struct cpufreq_frequency_table s3c2440_plls_169344[] = {
        { .frequency = 78019200,        .driver_data = PLLVAL(121, 5, 3),       },      /* FVco 624.153600 */
        { .frequency = 84067200,        .driver_data = PLLVAL(131, 5, 3),       },      /* FVco 672.537600 */
        { .frequency = 90115200,        .driver_data = PLLVAL(141, 5, 3),       },      /* FVco 720.921600 */
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 871f21783866..08f64b455aa8 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -3,6 +3,7 @@ config ARM64
        select ACPI_CCA_REQUIRED if ACPI
        select ACPI_GENERIC_GSI if ACPI
        select ACPI_REDUCED_HARDWARE_ONLY if ACPI
+        select ARCH_HAS_DEVMEM_IS_ALLOWED
        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
        select ARCH_HAS_ELF_RANDOMIZE
        select ARCH_HAS_GCOV_PROFILE_ALL
diff --git a/arch/arm64/Kconfig.debug b/arch/arm64/Kconfig.debug
index 04fb73b973f1..e13c4bf84d9e 100644
--- a/arch/arm64/Kconfig.debug
+++ b/arch/arm64/Kconfig.debug
@@ -14,20 +14,6 @@ config ARM64_PTDUMP
          kernel.
          If in doubt, say "N"
-config STRICT_DEVMEM
-        bool "Filter access to /dev/mem"
-        depends on MMU
-        help
-          If this option is disabled, you allow userspace (root) access to all
-          of memory, including kernel and userspace memory. Accidental
-          access to this is obviously disastrous, but specific access can
-          be used by people debugging the kernel.
-          If this option is switched on, the /dev/mem file only allows
-          userspace access to memory mapped peripherals.
-          If in doubt, say Y.
 config PID_IN_CONTEXTIDR
        bool "Write the current PID to the CONTEXTIDR register"
        help
diff --git a/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi
index e81cd48d6245..925552e7b4f3 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi
@@ -269,6 +269,7 @@
                        clock-frequency = <0>;  /* Updated by bootloader */
                        voltage-ranges = <1800 1800 3300 3300>;
                        sdhci,auto-cmd12;
+                        little-endian;
                        bus-width = <4>;
                };
@@ -277,6 +278,7 @@
                        reg = <0x0 0x2300000 0x0 0x10000>;
                        interrupts = <0 36 0x4>; /* Level high type */
                        gpio-controller;
+                        little-endian;
                        #gpio-cells = <2>;
                        interrupt-controller;
                        #interrupt-cells = <2>;
@@ -287,6 +289,7 @@
                        reg = <0x0 0x2310000 0x0 0x10000>;
                        interrupts = <0 36 0x4>; /* Level high type */
                        gpio-controller;
+                        little-endian;
                        #gpio-cells = <2>;
                        interrupt-controller;
                        #interrupt-cells = <2>;
@@ -297,6 +300,7 @@
                        reg = <0x0 0x2320000 0x0 0x10000>;
                        interrupts = <0 37 0x4>; /* Level high type */
                        gpio-controller;
+                        little-endian;
                        #gpio-cells = <2>;
                        interrupt-controller;
                        #interrupt-cells = <2>;
@@ -307,6 +311,7 @@
                        reg = <0x0 0x2330000 0x0 0x10000>;
                        interrupts = <0 37 0x4>; /* Level high type */
                        gpio-controller;
+                        little-endian;
                        #gpio-cells = <2>;
                        interrupt-controller;
                        #interrupt-cells = <2>;
diff --git a/arch/arm64/include/asm/arch_gicv3.h b/arch/arm64/include/asm/arch_gicv3.h
index 030cdcb46c6b..2731d3b25ed2 100644
--- a/arch/arm64/include/asm/arch_gicv3.h
+++ b/arch/arm64/include/asm/arch_gicv3.h
@@ -77,6 +77,7 @@
 #ifndef __ASSEMBLY__
 #include <linux/stringify.h>
+#include <asm/barrier.h>
 /*
 * Low-level accessors
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 7e074f93f383..63f52b55defe 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -276,10 +276,14 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
         * hardware updates of the pte (ptep_set_access_flags safely changes
         * valid ptes without going through an invalid entry).
         */
-        if (IS_ENABLED(CONFIG_DEBUG_VM) && IS_ENABLED(CONFIG_ARM64_HW_AFDBM) &&
+        if (IS_ENABLED(CONFIG_ARM64_HW_AFDBM) &&
-            pte_valid(*ptep)) {
+            pte_valid(*ptep) && pte_valid(pte)) {
-                BUG_ON(!pte_young(pte));
+                VM_WARN_ONCE(!pte_young(pte),
-                BUG_ON(pte_write(*ptep) && !pte_dirty(pte));
+                             "%s: racy access flag clearing: 0x%016llx -> 0x%016llx",
+                             __func__, pte_val(*ptep), pte_val(pte));
+                VM_WARN_ONCE(pte_write(*ptep) && !pte_dirty(pte),
+                             "%s: racy dirty state clearing: 0x%016llx -> 0x%016llx",
+                             __func__, pte_val(*ptep), pte_val(pte));
        }
        set_pte(ptep, pte);
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 1ee2c3937d4e..71426a78db12 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -5,6 +5,7 @@
 */
 #include <asm-generic/vmlinux.lds.h>
+#include <asm/cache.h>
 #include <asm/kernel-pgtable.h>
 #include <asm/thread_info.h>
 #include <asm/memory.h>
@@ -140,7 +141,7 @@ SECTIONS
                ARM_EXIT_KEEP(EXIT_DATA)
        }
-        PERCPU_SECTION(64)
+        PERCPU_SECTION(L1_CACHE_BYTES)
        . = ALIGN(PAGE_SIZE);
        __init_end = .;
@@ -158,7 +159,7 @@ SECTIONS
        . = ALIGN(PAGE_SIZE);
        _data = .;
        _sdata = .;
-        RW_DATA_SECTION(64, PAGE_SIZE, THREAD_SIZE)
+        RW_DATA_SECTION(L1_CACHE_BYTES, PAGE_SIZE, THREAD_SIZE)
        PECOFF_EDATA_PADDING
        _edata = .;
diff --git a/arch/blackfin/kernel/perf_event.c b/arch/blackfin/kernel/perf_event.c
index 1e9c8b0bf486..170d786807c4 100644
--- a/arch/blackfin/kernel/perf_event.c
+++ b/arch/blackfin/kernel/perf_event.c
@@ -14,7 +14,7 @@
 *  Copyright (C) 2008-2009 Red Hat, Inc., Ingo Molnar
 *  Copyright (C) 2009 Jaswinder Singh Rajput
 *  Copyright (C) 2009 Advanced Micro Devices, Inc., Robert Richter
- *  Copyright (C) 2008-2009 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2008-2009 Red Hat, Inc., Peter Zijlstra
 *  Copyright (C) 2009 Intel Corporation, <markus.t.metzger@intel.com>
 *
 * ppc:
diff --git a/arch/frv/Kconfig b/arch/frv/Kconfig
index 34aa19352dc1..03bfd6bf03e7 100644
--- a/arch/frv/Kconfig
+++ b/arch/frv/Kconfig
@@ -10,6 +10,7 @@ config FRV
        select HAVE_DEBUG_BUGVERBOSE
        select ARCH_HAVE_NMI_SAFE_CMPXCHG
        select GENERIC_CPU_DEVICES
+        select ARCH_HAS_DEVMEM_IS_ALLOWED
        select ARCH_WANT_IPC_PARSE_VERSION
        select OLD_SIGSUSPEND3
        select OLD_SIGACTION
diff --git a/arch/m32r/Kconfig b/arch/m32r/Kconfig
index 9e44bbd8051e..836ac5a963c8 100644
--- a/arch/m32r/Kconfig
+++ b/arch/m32r/Kconfig
@@ -13,6 +13,7 @@ config M32R
        select GENERIC_IRQ_PROBE
        select GENERIC_IRQ_SHOW
        select GENERIC_ATOMIC64
+        select ARCH_HAS_DEVMEM_IS_ALLOWED
        select ARCH_USES_GETTIMEOFFSET
        select MODULES_USE_ELF_RELA
        select HAVE_DEBUG_STACKOVERFLOW
diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
index d8117be729a2..730d394ce5f0 100644
--- a/arch/mips/mm/dma-default.c
+++ b/arch/mips/mm/dma-default.c
@@ -145,7 +145,7 @@ static void *mips_dma_alloc_coherent(struct device *dev, size_t size,
        gfp = massage_gfp_flags(dev, gfp);
-        if (IS_ENABLED(CONFIG_DMA_CMA) && !(gfp & GFP_ATOMIC))
+        if (IS_ENABLED(CONFIG_DMA_CMA) && gfpflags_allow_blocking(gfp))
                page = dma_alloc_from_contiguous(dev,
                                        count, get_order(size));
        if (!page)
diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
index d8534f95915a..291cee28ccb6 100644
--- a/arch/parisc/include/asm/pgtable.h
+++ b/arch/parisc/include/asm/pgtable.h
@@ -372,7 +372,8 @@ static inline pte_t pte_mkspecial(pte_t pte)	{ return pte; }
 */
 #ifdef CONFIG_HUGETLB_PAGE
 #define pte_huge(pte)           (pte_val(pte) & _PAGE_HUGE)
-#define pte_mkhuge(pte)         (__pte(pte_val(pte) | _PAGE_HUGE))
+#define pte_mkhuge(pte)         (__pte(pte_val(pte) | \
+                                 (parisc_requires_coherency() ? 0 : _PAGE_HUGE)))
 #else
 #define pte_huge(pte)           (0)
 #define pte_mkhuge(pte)         (pte)
diff --git a/arch/parisc/include/uapi/asm/unistd.h b/arch/parisc/include/uapi/asm/unistd.h
index 33170384d3ac..35bdccbb2036 100644
--- a/arch/parisc/include/uapi/asm/unistd.h
+++ b/arch/parisc/include/uapi/asm/unistd.h
@@ -360,8 +360,9 @@
 #define __NR_execveat           (__NR_Linux + 342)
 #define __NR_membarrier         (__NR_Linux + 343)
 #define __NR_userfaultfd        (__NR_Linux + 344)
+#define __NR_mlock2             (__NR_Linux + 345)
-#define __NR_Linux_syscalls     (__NR_userfaultfd + 1)
+#define __NR_Linux_syscalls     (__NR_mlock2 + 1)
 #define __IGNORE_select         /* newselect */
diff --git a/arch/parisc/kernel/pci.c b/arch/parisc/kernel/pci.c
index 64f2764a8cef..c99f3dde455c 100644
--- a/arch/parisc/kernel/pci.c
+++ b/arch/parisc/kernel/pci.c
@@ -171,24 +171,6 @@ void pcibios_set_master(struct pci_dev *dev)
 }
-void __init pcibios_init_bus(struct pci_bus *bus)
-{
-        struct pci_dev *dev = bus->self;
-        unsigned short bridge_ctl;
-        /* We deal only with pci controllers and pci-pci bridges. */
-        if (!dev || (dev->class >> 8) != PCI_CLASS_BRIDGE_PCI)
-                return;
-        /* PCI-PCI bridge - set the cache line and default latency
-           (32) for primary and secondary buses. */
-        pci_write_config_byte(dev, PCI_SEC_LATENCY_TIMER, 32);
-        pci_read_config_word(dev, PCI_BRIDGE_CONTROL, &bridge_ctl);
-        bridge_ctl |= PCI_BRIDGE_CTL_PARITY | PCI_BRIDGE_CTL_SERR;
-        pci_write_config_word(dev, PCI_BRIDGE_CONTROL, bridge_ctl);
-}
 /*
 * pcibios align resources() is called every time generic PCI code
 * wants to generate a new address. The process of looking for
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index 78c3ef8c348d..d4ffcfbc9885 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -440,6 +440,7 @@
        ENTRY_COMP(execveat)
        ENTRY_SAME(membarrier)
        ENTRY_SAME(userfaultfd)
+        ENTRY_SAME(mlock2)              /* 345 */
 .ifne (. - 90b) - (__NR_Linux_syscalls * (91b - 90b))
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index db49e0d796b1..85eabc49de61 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -159,6 +159,7 @@ config PPC
        select EDAC_SUPPORT
        select EDAC_ATOMIC_SCRUB
        select ARCH_HAS_DMA_SET_COHERENT_MASK
+        select ARCH_HAS_DEVMEM_IS_ALLOWED
        select HAVE_ARCH_SECCOMP_FILTER
 config GENERIC_CSUM
diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
index 3a510f4a6b68..a0e44a9c456f 100644
--- a/arch/powerpc/Kconfig.debug
+++ b/arch/powerpc/Kconfig.debug
@@ -335,18 +335,6 @@ config PPC_EARLY_DEBUG_CPM_ADDR
          platform probing is done, all platforms selected must
          share the same address.
-config STRICT_DEVMEM
-        def_bool y
-        prompt "Filter access to /dev/mem"
-        help
-          This option restricts access to /dev/mem.  If this option is
-          disabled, you allow userspace access to all memory, including
-          kernel and userspace memory. Accidental memory access is likely
-          to be disastrous.
-          Memory access is required for experts who want to debug the kernel.
-          If you are unsure, say Y.
 config FAIL_IOMMU
        bool "Fault-injection capability for IOMMU"
        depends on FAULT_INJECTION
diff --git a/arch/powerpc/boot/dts/sbc8641d.dts b/arch/powerpc/boot/dts/sbc8641d.dts
index 631ede72e226..68f0ed7626bd 100644
--- a/arch/powerpc/boot/dts/sbc8641d.dts
+++ b/arch/powerpc/boot/dts/sbc8641d.dts
@@ -227,23 +227,15 @@
                                reg = <0x520 0x20>;
                                phy0: ethernet-phy@1f {
-                                        interrupt-parent = <&mpic>;
-                                        interrupts = <10 1>;
                                        reg = <0x1f>;
                                };
                                phy1: ethernet-phy@0 {
-                                        interrupt-parent = <&mpic>;
-                                        interrupts = <10 1>;
                                        reg = <0>;
                                };
                                phy2: ethernet-phy@1 {
-                                        interrupt-parent = <&mpic>;
-                                        interrupts = <10 1>;
                                        reg = <1>;
                                };
                                phy3: ethernet-phy@2 {
-                                        interrupt-parent = <&mpic>;
-                                        interrupts = <10 1>;
                                        reg = <2>;
                                };
                                tbi0: tbi-phy@11 {
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index 80dfe8965df9..8d14feb40f12 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -590,16 +590,10 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus)
        eeh_ops->configure_bridge(pe);
        eeh_pe_restore_bars(pe);
-        /*
+        /* Clear frozen state */
-         * If it's PHB PE, the frozen state on all available PEs should have
+        rc = eeh_clear_pe_frozen_state(pe, false);
-         * been cleared by the PHB reset. Otherwise, we unfreeze the PE and its
+        if (rc)
-         * child PEs because they might be in frozen state.
+                return rc;
-         */
-        if (!(pe->type & EEH_PE_PHB)) {
-                rc = eeh_clear_pe_frozen_state(pe, false);
-                if (rc)
-                        return rc;
-        }
        /* Give the system 5 seconds to finish running the user-space
         * hotplug shutdown scripts, e.g. ifdown for ethernet.  Yes,
diff --git a/arch/powerpc/platforms/powernv/opal-irqchip.c b/arch/powerpc/platforms/powernv/opal-irqchip.c
index 6ccfb6c1c707..0a00e2aed393 100644
--- a/arch/powerpc/platforms/powernv/opal-irqchip.c
+++ b/arch/powerpc/platforms/powernv/opal-irqchip.c
@@ -43,11 +43,34 @@ static unsigned int opal_irq_count;
 static unsigned int *opal_irqs;
 static void opal_handle_irq_work(struct irq_work *work);
-static __be64 last_outstanding_events;
+static u64 last_outstanding_events;
 static struct irq_work opal_event_irq_work = {
        .func = opal_handle_irq_work,
 };
+void opal_handle_events(uint64_t events)
+{
+        int virq, hwirq = 0;
+        u64 mask = opal_event_irqchip.mask;
+        if (!in_irq() && (events & mask)) {
+                last_outstanding_events = events;
+                irq_work_queue(&opal_event_irq_work);
+                return;
+        }
+        while (events & mask) {
+                hwirq = fls64(events) - 1;
+                if (BIT_ULL(hwirq) & mask) {
+                        virq = irq_find_mapping(opal_event_irqchip.domain,
+                                                hwirq);
+                        if (virq)
+                                generic_handle_irq(virq);
+                }
+                events &= ~BIT_ULL(hwirq);
+        }
+}
 static void opal_event_mask(struct irq_data *d)
 {
        clear_bit(d->hwirq, &opal_event_irqchip.mask);
@@ -55,12 +78,12 @@ static void opal_event_mask(struct irq_data *d)
 static void opal_event_unmask(struct irq_data *d)
 {
+        __be64 events;
        set_bit(d->hwirq, &opal_event_irqchip.mask);
-        opal_poll_events(&last_outstanding_events);
+        opal_poll_events(&events);
-        if (last_outstanding_events & opal_event_irqchip.mask)
+        opal_handle_events(be64_to_cpu(events));
-                /* Need to retrigger the interrupt */
-                irq_work_queue(&opal_event_irq_work);
 }
 static int opal_event_set_type(struct irq_data *d, unsigned int flow_type)
@@ -96,29 +119,6 @@ static int opal_event_map(struct irq_domain *d, unsigned int irq,
        return 0;
 }
-void opal_handle_events(uint64_t events)
-{
-        int virq, hwirq = 0;
-        u64 mask = opal_event_irqchip.mask;
-        if (!in_irq() && (events & mask)) {
-                last_outstanding_events = events;
-                irq_work_queue(&opal_event_irq_work);
-                return;
-        }
-        while (events & mask) {
-                hwirq = fls64(events) - 1;
-                if (BIT_ULL(hwirq) & mask) {
-                        virq = irq_find_mapping(opal_event_irqchip.domain,
-                                                hwirq);
-                        if (virq)
-                                generic_handle_irq(virq);
-                }
-                events &= ~BIT_ULL(hwirq);
-        }
-}
 static irqreturn_t opal_interrupt(int irq, void *data)
 {
        __be64 events;
@@ -131,7 +131,7 @@ static irqreturn_t opal_interrupt(int irq, void *data)
 static void opal_handle_irq_work(struct irq_work *work)
 {
-        opal_handle_events(be64_to_cpu(last_outstanding_events));
+        opal_handle_events(last_outstanding_events);
 }
 static int opal_event_match(struct irq_domain *h, struct device_node *node,
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 3a55f493c7da..779becb895be 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -66,6 +66,7 @@ config S390
        def_bool y
        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
        select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
+        select ARCH_HAS_DEVMEM_IS_ALLOWED
        select ARCH_HAS_ELF_RANDOMIZE
        select ARCH_HAS_GCOV_PROFILE_ALL
        select ARCH_HAS_SG_CHAIN
diff --git a/arch/s390/Kconfig.debug b/arch/s390/Kconfig.debug
index c56878e1245f..26c5d5beb4be 100644
--- a/arch/s390/Kconfig.debug
+++ b/arch/s390/Kconfig.debug
@@ -5,18 +5,6 @@ config TRACE_IRQFLAGS_SUPPORT
 source "lib/Kconfig.debug"
-config STRICT_DEVMEM
-        def_bool y
-        prompt "Filter access to /dev/mem"
-        ---help---
-          This option restricts access to /dev/mem.  If this option is
-          disabled, you allow userspace access to all memory, including
-          kernel and userspace memory. Accidental memory access is likely
-          to be disastrous.
-          Memory access is required for experts who want to debug the kernel.
-          If you are unsure, say Y.
 config S390_PTDUMP
        bool "Export kernel pagetable layout to userspace via debugfs"
        depends on DEBUG_KERNEL
diff --git a/arch/sh/include/uapi/asm/unistd_64.h b/arch/sh/include/uapi/asm/unistd_64.h
index e6820c86e8c7..47ebd5b5ed55 100644
--- a/arch/sh/include/uapi/asm/unistd_64.h
+++ b/arch/sh/include/uapi/asm/unistd_64.h
@@ -278,7 +278,7 @@
 #define __NR_fsetxattr          256
 #define __NR_getxattr           257
 #define __NR_lgetxattr          258
-#define __NR_fgetxattr          269
+#define __NR_fgetxattr          259
 #define __NR_listxattr          260
 #define __NR_llistxattr         261
 #define __NR_flistxattr         262
diff --git a/arch/sh/kernel/perf_event.c b/arch/sh/kernel/perf_event.c
index 7cfd7f153966..4dca18347ee9 100644
--- a/arch/sh/kernel/perf_event.c
+++ b/arch/sh/kernel/perf_event.c
@@ -10,7 +10,7 @@
 *  Copyright (C) 2008-2009 Red Hat, Inc., Ingo Molnar
 *  Copyright (C) 2009 Jaswinder Singh Rajput
 *  Copyright (C) 2009 Advanced Micro Devices, Inc., Robert Richter
- *  Copyright (C) 2008-2009 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2008-2009 Red Hat, Inc., Peter Zijlstra
 *  Copyright (C) 2009 Intel Corporation, <markus.t.metzger@intel.com>
 *
 * ppc:
diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
index b0da5aedb336..3091267c5cc3 100644
--- a/arch/sparc/kernel/perf_event.c
+++ b/arch/sparc/kernel/perf_event.c
@@ -9,7 +9,7 @@
 *  Copyright (C) 2008-2009 Red Hat, Inc., Ingo Molnar
 *  Copyright (C) 2009 Jaswinder Singh Rajput
 *  Copyright (C) 2009 Advanced Micro Devices, Inc., Robert Richter
- *  Copyright (C) 2008-2009 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2008-2009 Red Hat, Inc., Peter Zijlstra
 */
 #include <linux/perf_event.h>
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index 106c21bd7f44..cf3116887509 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
@@ -19,6 +19,7 @@ config TILE
        select VIRT_TO_BUS
        select SYS_HYPERVISOR
        select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
+        select ARCH_HAS_DEVMEM_IS_ALLOWED
        select ARCH_HAVE_NMI_SAFE_CMPXCHG
        select GENERIC_CLOCKEVENTS
        select MODULES_USE_ELF_RELA
@@ -116,9 +117,6 @@ config ARCH_DISCONTIGMEM_DEFAULT
 config TRACE_IRQFLAGS_SUPPORT
        def_bool y
-config STRICT_DEVMEM
-        def_bool y
 # SMP is required for Tilera Linux.
 config SMP
        def_bool y
diff --git a/arch/tile/kernel/perf_event.c b/arch/tile/kernel/perf_event.c
index bb509cee3b59..8767060d70fb 100644
--- a/arch/tile/kernel/perf_event.c
+++ b/arch/tile/kernel/perf_event.c
@@ -21,7 +21,7 @@
 *  Copyright (C) 2008-2009 Red Hat, Inc., Ingo Molnar
 *  Copyright (C) 2009 Jaswinder Singh Rajput
 *  Copyright (C) 2009 Advanced Micro Devices, Inc., Robert Richter
- *  Copyright (C) 2008-2009 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2008-2009 Red Hat, Inc., Peter Zijlstra
 *  Copyright (C) 2009 Intel Corporation, <markus.t.metzger@intel.com>
 *  Copyright (C) 2009 Google, Inc., Stephane Eranian
 */
diff --git a/arch/um/Makefile b/arch/um/Makefile
index 25ed4098640e..e3abe6f3156d 100644
--- a/arch/um/Makefile
+++ b/arch/um/Makefile
@@ -131,7 +131,7 @@ export LDS_ELF_FORMAT := $(ELF_FORMAT)
 # The wrappers will select whether using "malloc" or the kernel allocator.
 LINK_WRAPS = -Wl,--wrap,malloc -Wl,--wrap,free -Wl,--wrap,calloc
-LD_FLAGS_CMDLINE = $(foreach opt,$(LDFLAGS),-Wl,$(opt)) -lrt
+LD_FLAGS_CMDLINE = $(foreach opt,$(LDFLAGS),-Wl,$(opt))
 # Used by link-vmlinux.sh which has special support for um link
 export CFLAGS_vmlinux := $(LINK-y) $(LINK_WRAPS) $(LD_FLAGS_CMDLINE)
diff --git a/arch/um/drivers/net_user.c b/arch/um/drivers/net_user.c
index e697a4136707..e9f8445861dc 100644
--- a/arch/um/drivers/net_user.c
+++ b/arch/um/drivers/net_user.c
@@ -249,21 +249,23 @@ void close_addr(unsigned char *addr, unsigned char *netmask, void *arg)
 char *split_if_spec(char *str, ...)
 {
-        char **arg, *end;
+        char **arg, *end, *ret = NULL;
        va_list ap;
        va_start(ap, str);
        while ((arg = va_arg(ap, char **)) != NULL) {
                if (*str == '\0')
-                        return NULL;
+                        goto out;
                end = strchr(str, ',');
                if (end != str)
                        *arg = str;
                if (end == NULL)
-                        return NULL;
+                        goto out;
                *end++ = '\0';
                str = end;
        }
+        ret = str;
+out:
        va_end(ap);
-        return str;
+        return ret;
 }
diff --git a/arch/um/kernel/signal.c b/arch/um/kernel/signal.c
index 57acbd67d85d..fc8be0e3a4ff 100644
--- a/arch/um/kernel/signal.c
+++ b/arch/um/kernel/signal.c
@@ -69,7 +69,7 @@ void do_signal(struct pt_regs *regs)
        struct ksignal ksig;
        int handled_sig = 0;
-        while (get_signal(&ksig)) {
+        if (get_signal(&ksig)) {
                handled_sig = 1;
                /* Whee!  Actually deliver the signal.  */
                handle_signal(&ksig, regs);
diff --git a/arch/unicore32/Kconfig b/arch/unicore32/Kconfig
index c9faddc61100..5dc4c0a43ccd 100644
--- a/arch/unicore32/Kconfig
+++ b/arch/unicore32/Kconfig
@@ -1,5 +1,6 @@
 config UNICORE32
        def_bool y
+        select ARCH_HAS_DEVMEM_IS_ALLOWED
        select ARCH_MIGHT_HAVE_PC_PARPORT
        select ARCH_MIGHT_HAVE_PC_SERIO
        select HAVE_MEMBLOCK
diff --git a/arch/unicore32/Kconfig.debug b/arch/unicore32/Kconfig.debug
index 1a3626239843..f075bbe1d46f 100644
--- a/arch/unicore32/Kconfig.debug
+++ b/arch/unicore32/Kconfig.debug
@@ -2,20 +2,6 @@ menu "Kernel hacking"
 source "lib/Kconfig.debug"
-config STRICT_DEVMEM
-        bool "Filter access to /dev/mem"
-        depends on MMU
-        ---help---
-          If this option is disabled, you allow userspace (root) access to all
-          of memory, including kernel and userspace memory. Accidental
-          access to this is obviously disastrous, but specific access can
-          be used by people debugging the kernel.
-          If this option is switched on, the /dev/mem file only allows
-          userspace access to memory mapped peripherals.
-          If in doubt, say Y.
 config EARLY_PRINTK
        def_bool DEBUG_OCD
        help
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index db3622f22b61..75fba1fc205d 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -24,6 +24,7 @@ config X86
        select ARCH_DISCARD_MEMBLOCK
        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
        select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
+        select ARCH_HAS_DEVMEM_IS_ALLOWED
        select ARCH_HAS_ELF_RANDOMIZE
        select ARCH_HAS_FAST_MULTIPLIER
        select ARCH_HAS_GCOV_PROFILE_ALL
diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index 137dfa96aa14..1116452fcfc2 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -5,23 +5,6 @@ config TRACE_IRQFLAGS_SUPPORT
 source "lib/Kconfig.debug"
-config STRICT_DEVMEM
-        bool "Filter access to /dev/mem"
-        ---help---
-          If this option is disabled, you allow userspace (root) access to all
-          of memory, including kernel and userspace memory. Accidental
-          access to this is obviously disastrous, but specific access can
-          be used by people debugging the kernel. Note that with PAT support
-          enabled, even in this case there are restrictions on /dev/mem
-          use due to the cache aliasing requirements.
-          If this option is switched on, the /dev/mem file only allows
-          userspace access to PCI space and the BIOS code and data regions.
-          This is sufficient for dosemu and X and all common users of
-          /dev/mem.
-          If in doubt, say Y.
 config X86_VERBOSE_BOOTUP
        bool "Enable verbose x86 bootup info messages"
        default y
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 4562cf070c27..2bf79d7c97df 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -5,7 +5,7 @@
 *  Copyright (C) 2008-2009 Red Hat, Inc., Ingo Molnar
 *  Copyright (C) 2009 Jaswinder Singh Rajput
 *  Copyright (C) 2009 Advanced Micro Devices, Inc., Robert Richter
- *  Copyright (C) 2008-2009 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2008-2009 Red Hat, Inc., Peter Zijlstra
 *  Copyright (C) 2009 Intel Corporation, <markus.t.metzger@intel.com>
 *  Copyright (C) 2009 Google, Inc., Stephane Eranian
 *
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index 499f533dd3cc..d0e35ebb2adb 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -5,7 +5,7 @@
 *  Copyright (C) 2008-2009 Red Hat, Inc., Ingo Molnar
 *  Copyright (C) 2009 Jaswinder Singh Rajput
 *  Copyright (C) 2009 Advanced Micro Devices, Inc., Robert Richter
- *  Copyright (C) 2008-2009 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2008-2009 Red Hat, Inc., Peter Zijlstra
 *  Copyright (C) 2009 Intel Corporation, <markus.t.metzger@intel.com>
 *  Copyright (C) 2009 Google, Inc., Stephane Eranian
 *
@@ -387,7 +387,7 @@ struct cpu_hw_events {
 /* Check flags and event code/umask, and set the HSW N/A flag */
 #define INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_NA(code, n) \
        __EVENT_CONSTRAINT(code, n,                     \
-                          INTEL_ARCH_EVENT_MASK|INTEL_ARCH_EVENT_MASK, \
+                          INTEL_ARCH_EVENT_MASK|X86_ALL_EVENT_FLAGS, \
                          HWEIGHT(n), 0, PERF_X86_EVENT_PEBS_NA_HSW)
@@ -627,6 +627,7 @@ struct x86_perf_task_context {
        u64 lbr_from[MAX_LBR_ENTRIES];
        u64 lbr_to[MAX_LBR_ENTRIES];
        u64 lbr_info[MAX_LBR_ENTRIES];
+        int tos;
        int lbr_callstack_users;
        int lbr_stack_state;
 };
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index f63360be2238..e2a430021e46 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -232,7 +232,7 @@ static struct event_constraint intel_hsw_event_constraints[] = {
        FIXED_EVENT_CONSTRAINT(0x00c0, 0), /* INST_RETIRED.ANY */
        FIXED_EVENT_CONSTRAINT(0x003c, 1), /* CPU_CLK_UNHALTED.CORE */
        FIXED_EVENT_CONSTRAINT(0x0300, 2), /* CPU_CLK_UNHALTED.REF */
-        INTEL_EVENT_CONSTRAINT(0x48, 0x4), /* L1D_PEND_MISS.* */
+        INTEL_UEVENT_CONSTRAINT(0x148, 0x4),    /* L1D_PEND_MISS.PENDING */
        INTEL_UEVENT_CONSTRAINT(0x01c0, 0x2), /* INST_RETIRED.PREC_DIST */
        INTEL_EVENT_CONSTRAINT(0xcd, 0x8), /* MEM_TRANS_RETIRED.LOAD_LATENCY */
        /* CYCLE_ACTIVITY.CYCLES_L1D_PENDING */
diff --git a/arch/x86/kernel/cpu/perf_event_intel_cqm.c b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
index 377e8f8ed391..a316ca96f1b6 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_cqm.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
@@ -298,7 +298,7 @@ static bool __match_event(struct perf_event *a, struct perf_event *b)
 static inline struct perf_cgroup *event_to_cgroup(struct perf_event *event)
 {
        if (event->attach_state & PERF_ATTACH_TASK)
-                return perf_cgroup_from_task(event->hw.target);
+                return perf_cgroup_from_task(event->hw.target, event->ctx);
        return event->cgrp;
 }
diff --git a/arch/x86/kernel/cpu/perf_event_intel_lbr.c b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
index bfd0b717e944..659f01e165d5 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_lbr.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
@@ -239,7 +239,7 @@ static void __intel_pmu_lbr_restore(struct x86_perf_task_context *task_ctx)
        }
        mask = x86_pmu.lbr_nr - 1;
-        tos = intel_pmu_lbr_tos();
+        tos = task_ctx->tos;
        for (i = 0; i < tos; i++) {
                lbr_idx = (tos - i) & mask;
                wrmsrl(x86_pmu.lbr_from + lbr_idx, task_ctx->lbr_from[i]);
@@ -247,6 +247,7 @@ static void __intel_pmu_lbr_restore(struct x86_perf_task_context *task_ctx)
                if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_INFO)
                        wrmsrl(MSR_LBR_INFO_0 + lbr_idx, task_ctx->lbr_info[i]);
        }
+        wrmsrl(x86_pmu.lbr_tos, tos);
        task_ctx->lbr_stack_state = LBR_NONE;
 }
@@ -270,6 +271,7 @@ static void __intel_pmu_lbr_save(struct x86_perf_task_context *task_ctx)
                if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_INFO)
                        rdmsrl(MSR_LBR_INFO_0 + lbr_idx, task_ctx->lbr_info[i]);
        }
+        task_ctx->tos = tos;
        task_ctx->lbr_stack_state = LBR_VALID;
 }
diff --git a/arch/x86/kernel/irq_work.c b/arch/x86/kernel/irq_work.c
index dc5fa6a1e8d6..3512ba607361 100644
--- a/arch/x86/kernel/irq_work.c
+++ b/arch/x86/kernel/irq_work.c
@@ -1,7 +1,7 @@
 /*
 * x86 specific code for irq_work
 *
- * Copyright (C) 2010 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ * Copyright (C) 2010 Red Hat, Inc., Peter Zijlstra
 */
 #include <linux/kernel.h>
diff --git a/arch/x86/um/signal.c b/arch/x86/um/signal.c
index 06934a8a4872..e5f854ce2d72 100644
--- a/arch/x86/um/signal.c
+++ b/arch/x86/um/signal.c
@@ -211,7 +211,7 @@ static int copy_sc_from_user(struct pt_regs *regs,
                if (err)
                        return 1;
-                err = convert_fxsr_from_user(&fpx, sc.fpstate);
+                err = convert_fxsr_from_user(&fpx, (void *)sc.fpstate);
                if (err)
                        return 1;
@@ -227,7 +227,7 @@ static int copy_sc_from_user(struct pt_regs *regs,
        {
                struct user_i387_struct fp;
-                err = copy_from_user(&fp, sc.fpstate,
+                err = copy_from_user(&fp, (void *)sc.fpstate,
                                     sizeof(struct user_i387_struct));
                if (err)
                        return 1;
@@ -291,7 +291,7 @@ static int copy_sc_to_user(struct sigcontext __user *to,
 #endif
 #undef PUTREG
        sc.oldmask = mask;
-        sc.fpstate = to_fp;
+        sc.fpstate = (unsigned long)to_fp;
        err = copy_to_user(to, &sc, sizeof(struct sigcontext));
        if (err)
@@ -468,12 +468,10 @@ long sys_sigreturn(void)
        struct sigframe __user *frame = (struct sigframe __user *)(sp - 8);
        sigset_t set;
        struct sigcontext __user *sc = &frame->sc;
-        unsigned long __user *oldmask = &sc->oldmask;
-        unsigned long __user *extramask = frame->extramask;
        int sig_size = (_NSIG_WORDS - 1) * sizeof(unsigned long);
-        if (copy_from_user(&set.sig[0], oldmask, sizeof(set.sig[0])) ||
+        if (copy_from_user(&set.sig[0], (void *)sc->oldmask, sizeof(set.sig[0])) ||
-            copy_from_user(&set.sig[1], extramask, sig_size))
+            copy_from_user(&set.sig[1], frame->extramask, sig_size))
                goto segfault;
        set_current_blocked(&set);
@@ -505,6 +503,7 @@ int setup_signal_stack_si(unsigned long stack_top, struct ksignal *ksig,
 {
        struct rt_sigframe __user *frame;
        int err = 0, sig = ksig->sig;
+        unsigned long fp_to;
        frame = (struct rt_sigframe __user *)
                round_down(stack_top - sizeof(struct rt_sigframe), 16);
@@ -526,7 +525,10 @@ int setup_signal_stack_si(unsigned long stack_top, struct ksignal *ksig,
        err |= __save_altstack(&frame->uc.uc_stack, PT_REGS_SP(regs));
        err |= copy_sc_to_user(&frame->uc.uc_mcontext, &frame->fpstate, regs,
                               set->sig[0]);
-        err |= __put_user(&frame->fpstate, &frame->uc.uc_mcontext.fpstate);
+        fp_to = (unsigned long)&frame->fpstate;
+        err |= __put_user(fp_to, &frame->uc.uc_mcontext.fpstate);
        if (sizeof(*set) == 16) {
                err |= __put_user(set->sig[0], &frame->uc.uc_sigmask.sig[0]);
                err |= __put_user(set->sig[1], &frame->uc.uc_sigmask.sig[1]);
diff --git a/block/Makefile b/block/Makefile
index 00ecc97629db..db5f622c9d67 100644
--- a/block/Makefile
+++ b/block/Makefile
@@ -8,7 +8,7 @@ obj-$(CONFIG_BLOCK) := bio.o elevator.o blk-core.o blk-tag.o blk-sysfs.o \
                        blk-iopoll.o blk-lib.o blk-mq.o blk-mq-tag.o \
                        blk-mq-sysfs.o blk-mq-cpu.o blk-mq-cpumap.o ioctl.o \
                        genhd.o scsi_ioctl.o partition-generic.o ioprio.o \
-                        partitions/
+                        badblocks.o partitions/
 obj-$(CONFIG_BOUNCE)    += bounce.o
 obj-$(CONFIG_BLK_DEV_BSG)       += bsg.o
diff --git a/block/badblocks.c b/block/badblocks.c
new file mode 100644
index 000000000000..7be53cb1cc3c
--- /dev/null
+++ b/block/badblocks.c
@@ -0,0 +1,585 @@
+/*
+ * Bad block management
+ *
+ * - Heavily based on MD badblocks code from Neil Brown
+ *
+ * Copyright (c) 2015, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+#include <linux/badblocks.h>
+#include <linux/seqlock.h>
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/stddef.h>
+#include <linux/types.h>
+#include <linux/slab.h>
+/**
+ * badblocks_check() - check a given range for bad sectors
+ * @bb:         the badblocks structure that holds all badblock information
+ * @s:          sector (start) at which to check for badblocks
+ * @sectors:    number of sectors to check for badblocks
+ * @first_bad:  pointer to store location of the first badblock
+ * @bad_sectors: pointer to store number of badblocks after @first_bad
+ *
+ * We can record which blocks on each device are 'bad' and so just
+ * fail those blocks, or that stripe, rather than the whole device.
+ * Entries in the bad-block table are 64bits wide.  This comprises:
+ * Length of bad-range, in sectors: 0-511 for lengths 1-512
+ * Start of bad-range, sector offset, 54 bits (allows 8 exbibytes)
+ *  A 'shift' can be set so that larger blocks are tracked and
+ *  consequently larger devices can be covered.
+ * 'Acknowledged' flag - 1 bit. - the most significant bit.
+ *
+ * Locking of the bad-block table uses a seqlock so badblocks_check
+ * might need to retry if it is very unlucky.
+ * We will sometimes want to check for bad blocks in a bi_end_io function,
+ * so we use the write_seqlock_irq variant.
+ *
+ * When looking for a bad block we specify a range and want to
+ * know if any block in the range is bad.  So we binary-search
+ * to the last range that starts at-or-before the given endpoint,
+ * (or "before the sector after the target range")
+ * then see if it ends after the given start.
+ *
+ * Return:
+ *  0: there are no known bad blocks in the range
+ *  1: there are known bad block which are all acknowledged
+ * -1: there are bad blocks which have not yet been acknowledged in metadata.
+ * plus the start/length of the first bad section we overlap.
+ */
+int badblocks_check(struct badblocks *bb, sector_t s, int sectors,
+                        sector_t *first_bad, int *bad_sectors)
+{
+        int hi;
+        int lo;
+        u64 *p = bb->page;
+        int rv;
+        sector_t target = s + sectors;
+        unsigned seq;
+        if (bb->shift > 0) {
+                /* round the start down, and the end up */
+                s >>= bb->shift;
+                target += (1<<bb->shift) - 1;
+                target >>= bb->shift;
+                sectors = target - s;
+        }
+        /* 'target' is now the first block after the bad range */
+retry:
+        seq = read_seqbegin(&bb->lock);
+        lo = 0;
+        rv = 0;
+        hi = bb->count;
+        /* Binary search between lo and hi for 'target'
+         * i.e. for the last range that starts before 'target'
+         */
+        /* INVARIANT: ranges before 'lo' and at-or-after 'hi'
+         * are known not to be the last range before target.
+         * VARIANT: hi-lo is the number of possible
+         * ranges, and decreases until it reaches 1
+         */
+        while (hi - lo > 1) {
+                int mid = (lo + hi) / 2;
+                sector_t a = BB_OFFSET(p[mid]);
+                if (a < target)
+                        /* This could still be the one, earlier ranges
+                         * could not.
+                         */
+                        lo = mid;
+                else
+                        /* This and later ranges are definitely out. */
+                        hi = mid;
+        }
+        /* 'lo' might be the last that started before target, but 'hi' isn't */
+        if (hi > lo) {
+                /* need to check all range that end after 's' to see if
+                 * any are unacknowledged.
+                 */
+                while (lo >= 0 &&
+                       BB_OFFSET(p[lo]) + BB_LEN(p[lo]) > s) {
+                        if (BB_OFFSET(p[lo]) < target) {
+                                /* starts before the end, and finishes after
+                                 * the start, so they must overlap
+                                 */
+                                if (rv != -1 && BB_ACK(p[lo]))
+                                        rv = 1;
+                                else
+                                        rv = -1;
+                                *first_bad = BB_OFFSET(p[lo]);
+                                *bad_sectors = BB_LEN(p[lo]);
+                        }
+                        lo--;
+                }
+        }
+        if (read_seqretry(&bb->lock, seq))
+                goto retry;
+        return rv;
+}
+EXPORT_SYMBOL_GPL(badblocks_check);
+/**
+ * badblocks_set() - Add a range of bad blocks to the table.
+ * @bb:         the badblocks structure that holds all badblock information
+ * @s:          first sector to mark as bad
+ * @sectors:    number of sectors to mark as bad
+ * @acknowledged: weather to mark the bad sectors as acknowledged
+ *
+ * This might extend the table, or might contract it if two adjacent ranges
+ * can be merged. We binary-search to find the 'insertion' point, then
+ * decide how best to handle it.
+ *
+ * Return:
+ *  0: success
+ *  1: failed to set badblocks (out of space)
+ */
+int badblocks_set(struct badblocks *bb, sector_t s, int sectors,
+                        int acknowledged)
+{
+        u64 *p;
+        int lo, hi;
+        int rv = 0;
+        unsigned long flags;
+        if (bb->shift < 0)
+                /* badblocks are disabled */
+                return 0;
+        if (bb->shift) {
+                /* round the start down, and the end up */
+                sector_t next = s + sectors;
+                s >>= bb->shift;
+                next += (1<<bb->shift) - 1;
+                next >>= bb->shift;
+                sectors = next - s;
+        }
+        write_seqlock_irqsave(&bb->lock, flags);
+        p = bb->page;
+        lo = 0;
+        hi = bb->count;
+        /* Find the last range that starts at-or-before 's' */
+        while (hi - lo > 1) {
+                int mid = (lo + hi) / 2;
+                sector_t a = BB_OFFSET(p[mid]);
+                if (a <= s)
+                        lo = mid;
+                else
+                        hi = mid;
+        }
+        if (hi > lo && BB_OFFSET(p[lo]) > s)
+                hi = lo;
+        if (hi > lo) {
+                /* we found a range that might merge with the start
+                 * of our new range
+                 */
+                sector_t a = BB_OFFSET(p[lo]);
+                sector_t e = a + BB_LEN(p[lo]);
+                int ack = BB_ACK(p[lo]);
+                if (e >= s) {
+                        /* Yes, we can merge with a previous range */
+                        if (s == a && s + sectors >= e)
+                                /* new range covers old */
+                                ack = acknowledged;
+                        else
+                                ack = ack && acknowledged;
+                        if (e < s + sectors)
+                                e = s + sectors;
+                        if (e - a <= BB_MAX_LEN) {
+                                p[lo] = BB_MAKE(a, e-a, ack);
+                                s = e;
+                        } else {
+                                /* does not all fit in one range,
+                                 * make p[lo] maximal
+                                 */
+                                if (BB_LEN(p[lo]) != BB_MAX_LEN)
+                                        p[lo] = BB_MAKE(a, BB_MAX_LEN, ack);
+                                s = a + BB_MAX_LEN;
+                        }
+                        sectors = e - s;
+                }
+        }
+        if (sectors && hi < bb->count) {
+                /* 'hi' points to the first range that starts after 's'.
+                 * Maybe we can merge with the start of that range
+                 */
+                sector_t a = BB_OFFSET(p[hi]);
+                sector_t e = a + BB_LEN(p[hi]);
+                int ack = BB_ACK(p[hi]);
+                if (a <= s + sectors) {
+                        /* merging is possible */
+                        if (e <= s + sectors) {
+                                /* full overlap */
+                                e = s + sectors;
+                                ack = acknowledged;
+                        } else
+                                ack = ack && acknowledged;
+                        a = s;
+                        if (e - a <= BB_MAX_LEN) {
+                                p[hi] = BB_MAKE(a, e-a, ack);
+                                s = e;
+                        } else {
+                                p[hi] = BB_MAKE(a, BB_MAX_LEN, ack);
+                                s = a + BB_MAX_LEN;
+                        }
+                        sectors = e - s;
+                        lo = hi;
+                        hi++;
+                }
+        }
+        if (sectors == 0 && hi < bb->count) {
+                /* we might be able to combine lo and hi */
+                /* Note: 's' is at the end of 'lo' */
+                sector_t a = BB_OFFSET(p[hi]);
+                int lolen = BB_LEN(p[lo]);
+                int hilen = BB_LEN(p[hi]);
+                int newlen = lolen + hilen - (s - a);
+                if (s >= a && newlen < BB_MAX_LEN) {
+                        /* yes, we can combine them */
+                        int ack = BB_ACK(p[lo]) && BB_ACK(p[hi]);
+                        p[lo] = BB_MAKE(BB_OFFSET(p[lo]), newlen, ack);
+                        memmove(p + hi, p + hi + 1,
+                                (bb->count - hi - 1) * 8);
+                        bb->count--;
+                }
+        }
+        while (sectors) {
+                /* didn't merge (it all).
+                 * Need to add a range just before 'hi'
+                 */
+                if (bb->count >= MAX_BADBLOCKS) {
+                        /* No room for more */
+                        rv = 1;
+                        break;
+                } else {
+                        int this_sectors = sectors;
+                        memmove(p + hi + 1, p + hi,
+                                (bb->count - hi) * 8);
+                        bb->count++;
+                        if (this_sectors > BB_MAX_LEN)
+                                this_sectors = BB_MAX_LEN;
+                        p[hi] = BB_MAKE(s, this_sectors, acknowledged);
+                        sectors -= this_sectors;
+                        s += this_sectors;
+                }
+        }
+        bb->changed = 1;
+        if (!acknowledged)
+                bb->unacked_exist = 1;
+        write_sequnlock_irqrestore(&bb->lock, flags);
+        return rv;
+}
+EXPORT_SYMBOL_GPL(badblocks_set);
+/**
+ * badblocks_clear() - Remove a range of bad blocks to the table.
+ * @bb:         the badblocks structure that holds all badblock information
+ * @s:          first sector to mark as bad
+ * @sectors:    number of sectors to mark as bad
+ *
+ * This may involve extending the table if we spilt a region,
+ * but it must not fail.  So if the table becomes full, we just
+ * drop the remove request.
+ *
+ * Return:
+ *  0: success
+ *  1: failed to clear badblocks
+ */
+int badblocks_clear(struct badblocks *bb, sector_t s, int sectors)
+{
+        u64 *p;
+        int lo, hi;
+        sector_t target = s + sectors;
+        int rv = 0;
+        if (bb->shift > 0) {
+                /* When clearing we round the start up and the end down.
+                 * This should not matter as the shift should align with
+                 * the block size and no rounding should ever be needed.
+                 * However it is better the think a block is bad when it
+                 * isn't than to think a block is not bad when it is.
+                 */
+                s += (1<<bb->shift) - 1;
+                s >>= bb->shift;
+                target >>= bb->shift;
+                sectors = target - s;
+        }
+        write_seqlock_irq(&bb->lock);
+        p = bb->page;
+        lo = 0;
+        hi = bb->count;
+        /* Find the last range that starts before 'target' */
+        while (hi - lo > 1) {
+                int mid = (lo + hi) / 2;
+                sector_t a = BB_OFFSET(p[mid]);
+                if (a < target)
+                        lo = mid;
+                else
+                        hi = mid;
+        }
+        if (hi > lo) {
+                /* p[lo] is the last range that could overlap the
+                 * current range.  Earlier ranges could also overlap,
+                 * but only this one can overlap the end of the range.
+                 */
+                if (BB_OFFSET(p[lo]) + BB_LEN(p[lo]) > target) {
+                        /* Partial overlap, leave the tail of this range */
+                        int ack = BB_ACK(p[lo]);
+                        sector_t a = BB_OFFSET(p[lo]);
+                        sector_t end = a + BB_LEN(p[lo]);
+                        if (a < s) {
+                                /* we need to split this range */
+                                if (bb->count >= MAX_BADBLOCKS) {
+                                        rv = -ENOSPC;
+                                        goto out;
+                                }
+                                memmove(p+lo+1, p+lo, (bb->count - lo) * 8);
+                                bb->count++;
+                                p[lo] = BB_MAKE(a, s-a, ack);
+                                lo++;
+                        }
+                        p[lo] = BB_MAKE(target, end - target, ack);
+                        /* there is no longer an overlap */
+                        hi = lo;
+                        lo--;
+                }
+                while (lo >= 0 &&
+                       BB_OFFSET(p[lo]) + BB_LEN(p[lo]) > s) {
+                        /* This range does overlap */
+                        if (BB_OFFSET(p[lo]) < s) {
+                                /* Keep the early parts of this range. */
+                                int ack = BB_ACK(p[lo]);
+                                sector_t start = BB_OFFSET(p[lo]);
+                                p[lo] = BB_MAKE(start, s - start, ack);
+                                /* now low doesn't overlap, so.. */
+                                break;
+                        }
+                        lo--;
+                }
+                /* 'lo' is strictly before, 'hi' is strictly after,
+                 * anything between needs to be discarded
+                 */
+                if (hi - lo > 1) {
+                        memmove(p+lo+1, p+hi, (bb->count - hi) * 8);
+                        bb->count -= (hi - lo - 1);
+                }
+        }
+        bb->changed = 1;
+out:
+        write_sequnlock_irq(&bb->lock);
+        return rv;
+}
+EXPORT_SYMBOL_GPL(badblocks_clear);
+/**
+ * ack_all_badblocks() - Acknowledge all bad blocks in a list.
+ * @bb:         the badblocks structure that holds all badblock information
+ *
+ * This only succeeds if ->changed is clear.  It is used by
+ * in-kernel metadata updates
+ */
+void ack_all_badblocks(struct badblocks *bb)
+{
+        if (bb->page == NULL || bb->changed)
+                /* no point even trying */
+                return;
+        write_seqlock_irq(&bb->lock);
+        if (bb->changed == 0 && bb->unacked_exist) {
+                u64 *p = bb->page;
+                int i;
+                for (i = 0; i < bb->count ; i++) {
+                        if (!BB_ACK(p[i])) {
+                                sector_t start = BB_OFFSET(p[i]);
+                                int len = BB_LEN(p[i]);
+                                p[i] = BB_MAKE(start, len, 1);
+                        }
+                }
+                bb->unacked_exist = 0;
+        }
+        write_sequnlock_irq(&bb->lock);
+}
+EXPORT_SYMBOL_GPL(ack_all_badblocks);
+/**
+ * badblocks_show() - sysfs access to bad-blocks list
+ * @bb:         the badblocks structure that holds all badblock information
+ * @page:       buffer received from sysfs
+ * @unack:      weather to show unacknowledged badblocks
+ *
+ * Return:
+ *  Length of returned data
+ */
+ssize_t badblocks_show(struct badblocks *bb, char *page, int unack)
+{
+        size_t len;
+        int i;
+        u64 *p = bb->page;
+        unsigned seq;
+        if (bb->shift < 0)
+                return 0;
+retry:
+        seq = read_seqbegin(&bb->lock);
+        len = 0;
+        i = 0;
+        while (len < PAGE_SIZE && i < bb->count) {
+                sector_t s = BB_OFFSET(p[i]);
+                unsigned int length = BB_LEN(p[i]);
+                int ack = BB_ACK(p[i]);
+                i++;
+                if (unack && ack)
+                        continue;
+                len += snprintf(page+len, PAGE_SIZE-len, "%llu %u\n",
+                                (unsigned long long)s << bb->shift,
+                                length << bb->shift);
+        }
+        if (unack && len == 0)
+                bb->unacked_exist = 0;
+        if (read_seqretry(&bb->lock, seq))
+                goto retry;
+        return len;
+}
+EXPORT_SYMBOL_GPL(badblocks_show);
+/**
+ * badblocks_store() - sysfs access to bad-blocks list
+ * @bb:         the badblocks structure that holds all badblock information
+ * @page:       buffer received from sysfs
+ * @len:        length of data received from sysfs
+ * @unack:      weather to show unacknowledged badblocks
+ *
+ * Return:
+ *  Length of the buffer processed or -ve error.
+ */
+ssize_t badblocks_store(struct badblocks *bb, const char *page, size_t len,
+                        int unack)
+{
+        unsigned long long sector;
+        int length;
+        char newline;
+        switch (sscanf(page, "%llu %d%c", &sector, &length, &newline)) {
+        case 3:
+                if (newline != '\n')
+                        return -EINVAL;
+        case 2:
+                if (length <= 0)
+                        return -EINVAL;
+                break;
+        default:
+                return -EINVAL;
+        }
+        if (badblocks_set(bb, sector, length, !unack))
+                return -ENOSPC;
+        else
+                return len;
+}
+EXPORT_SYMBOL_GPL(badblocks_store);
+static int __badblocks_init(struct device *dev, struct badblocks *bb,
+                int enable)
+{
+        bb->dev = dev;
+        bb->count = 0;
+        if (enable)
+                bb->shift = 0;
+        else
+                bb->shift = -1;
+        if (dev)
+                bb->page = devm_kzalloc(dev, PAGE_SIZE, GFP_KERNEL);
+        else
+                bb->page = kzalloc(PAGE_SIZE, GFP_KERNEL);
+        if (!bb->page) {
+                bb->shift = -1;
+                return -ENOMEM;
+        }
+        seqlock_init(&bb->lock);
+        return 0;
+}
+/**
+ * badblocks_init() - initialize the badblocks structure
+ * @bb:         the badblocks structure that holds all badblock information
+ * @enable:     weather to enable badblocks accounting
+ *
+ * Return:
+ *  0: success
+ *  -ve errno: on error
+ */
+int badblocks_init(struct badblocks *bb, int enable)
+{
+        return __badblocks_init(NULL, bb, enable);
+}
+EXPORT_SYMBOL_GPL(badblocks_init);
+int devm_init_badblocks(struct device *dev, struct badblocks *bb)
+{
+        if (!bb)
+                return -EINVAL;
+        return __badblocks_init(dev, bb, 1);
+}
+EXPORT_SYMBOL_GPL(devm_init_badblocks);
+/**
+ * badblocks_exit() - free the badblocks structure
+ * @bb:         the badblocks structure that holds all badblock information
+ */
+void badblocks_exit(struct badblocks *bb)
+{
+        if (!bb)
+                return;
+        if (bb->dev)
+                devm_kfree(bb->dev, bb->page);
+        else
+                kfree(bb->page);
+        bb->page = NULL;
+}
+EXPORT_SYMBOL_GPL(badblocks_exit);
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 5bcdfc10c23a..5a37188b559f 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -1127,15 +1127,15 @@ void blkcg_exit_queue(struct request_queue *q)
 * of the main cic data structures.  For now we allow a task to change
 * its cgroup only if it's the only owner of its ioc.
 */
-static int blkcg_can_attach(struct cgroup_subsys_state *css,
+static int blkcg_can_attach(struct cgroup_taskset *tset)
-                            struct cgroup_taskset *tset)
 {
        struct task_struct *task;
+        struct cgroup_subsys_state *dst_css;
        struct io_context *ioc;
        int ret = 0;
        /* task_lock() is needed to avoid races with exit_io_context() */
-        cgroup_taskset_for_each(task, tset) {
+        cgroup_taskset_for_each(task, dst_css, tset) {
                task_lock(task);
                ioc = task->io_context;
                if (ioc && atomic_read(&ioc->nr_tasks) > 1)
diff --git a/block/blk-core.c b/block/blk-core.c
index a0af4043dda2..3636be469fa2 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -3405,6 +3405,9 @@ int blk_pre_runtime_suspend(struct request_queue *q)
 {
        int ret = 0;
+        if (!q->dev)
+                return ret;
        spin_lock_irq(q->queue_lock);
        if (q->nr_pending) {
                ret = -EBUSY;
@@ -3432,6 +3435,9 @@ EXPORT_SYMBOL(blk_pre_runtime_suspend);
 */
 void blk_post_runtime_suspend(struct request_queue *q, int err)
 {
+        if (!q->dev)
+                return;
        spin_lock_irq(q->queue_lock);
        if (!err) {
                q->rpm_status = RPM_SUSPENDED;
@@ -3456,6 +3462,9 @@ EXPORT_SYMBOL(blk_post_runtime_suspend);
 */
 void blk_pre_runtime_resume(struct request_queue *q)
 {
+        if (!q->dev)
+                return;
        spin_lock_irq(q->queue_lock);
        q->rpm_status = RPM_RESUMING;
        spin_unlock_irq(q->queue_lock);
@@ -3478,6 +3487,9 @@ EXPORT_SYMBOL(blk_pre_runtime_resume);
 */
 void blk_post_runtime_resume(struct request_queue *q, int err)
 {
+        if (!q->dev)
+                return;
        spin_lock_irq(q->queue_lock);
        if (!err) {
                q->rpm_status = RPM_ACTIVE;
diff --git a/block/genhd.c b/block/genhd.c
index e5cafa51567c..5aaeb2ad0fd3 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -20,6 +20,7 @@
 #include <linux/idr.h>
 #include <linux/log2.h>
 #include <linux/pm_runtime.h>
+#include <linux/badblocks.h>
 #include "blk.h"
@@ -664,7 +665,6 @@ void del_gendisk(struct gendisk *disk)
        kobject_put(disk->part0.holder_dir);
        kobject_put(disk->slave_dir);
-        disk->driverfs_dev = NULL;
        if (!sysfs_deprecated)
                sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk)));
        pm_runtime_set_memalloc_noio(disk_to_dev(disk), false);
@@ -672,6 +672,31 @@ void del_gendisk(struct gendisk *disk)
 }
 EXPORT_SYMBOL(del_gendisk);
+/* sysfs access to bad-blocks list. */
+static ssize_t disk_badblocks_show(struct device *dev,
+                                        struct device_attribute *attr,
+                                        char *page)
+{
+        struct gendisk *disk = dev_to_disk(dev);
+        if (!disk->bb)
+                return sprintf(page, "\n");
+        return badblocks_show(disk->bb, page, 0);
+}
+static ssize_t disk_badblocks_store(struct device *dev,
+                                        struct device_attribute *attr,
+                                        const char *page, size_t len)
+{
+        struct gendisk *disk = dev_to_disk(dev);
+        if (!disk->bb)
+                return -ENXIO;
+        return badblocks_store(disk->bb, page, len, 0);
+}
 /**
 * get_gendisk - get partitioning information for a given device
 * @devt: device to get partitioning information for
@@ -990,6 +1015,8 @@ static DEVICE_ATTR(discard_alignment, S_IRUGO, disk_discard_alignment_show,
 static DEVICE_ATTR(capability, S_IRUGO, disk_capability_show, NULL);
 static DEVICE_ATTR(stat, S_IRUGO, part_stat_show, NULL);
 static DEVICE_ATTR(inflight, S_IRUGO, part_inflight_show, NULL);
+static DEVICE_ATTR(badblocks, S_IRUGO | S_IWUSR, disk_badblocks_show,
+                disk_badblocks_store);
 #ifdef CONFIG_FAIL_MAKE_REQUEST
 static struct device_attribute dev_attr_fail =
        __ATTR(make-it-fail, S_IRUGO|S_IWUSR, part_fail_show, part_fail_store);
@@ -1011,6 +1038,7 @@ static struct attribute *disk_attrs[] = {
        &dev_attr_capability.attr,
        &dev_attr_stat.attr,
        &dev_attr_inflight.attr,
+        &dev_attr_badblocks.attr,
 #ifdef CONFIG_FAIL_MAKE_REQUEST
        &dev_attr_fail.attr,
 #endif
diff --git a/block/ioctl.c b/block/ioctl.c
index 0918aed2d847..2c84683aada5 100644
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -4,6 +4,7 @@
 #include <linux/gfp.h>
 #include <linux/blkpg.h>
 #include <linux/hdreg.h>
+#include <linux/badblocks.h>
 #include <linux/backing-dev.h>
 #include <linux/fs.h>
 #include <linux/blktrace_api.h>
@@ -406,6 +407,71 @@ static inline int is_unrecognized_ioctl(int ret)
                ret == -ENOIOCTLCMD;
 }
+#ifdef CONFIG_FS_DAX
+bool blkdev_dax_capable(struct block_device *bdev)
+{
+        struct gendisk *disk = bdev->bd_disk;
+        if (!disk->fops->direct_access)
+                return false;
+        /*
+         * If the partition is not aligned on a page boundary, we can't
+         * do dax I/O to it.
+         */
+        if ((bdev->bd_part->start_sect % (PAGE_SIZE / 512))
+                        || (bdev->bd_part->nr_sects % (PAGE_SIZE / 512)))
+                return false;
+        /*
+         * If the device has known bad blocks, force all I/O through the
+         * driver / page cache.
+         *
+         * TODO: support finer grained dax error handling
+         */
+        if (disk->bb && disk->bb->count)
+                return false;
+        return true;
+}
+static int blkdev_daxset(struct block_device *bdev, unsigned long argp)
+{
+        unsigned long arg;
+        int rc = 0;
+        if (!capable(CAP_SYS_ADMIN))
+                return -EACCES;
+        if (get_user(arg, (int __user *)(argp)))
+                return -EFAULT;
+        arg = !!arg;
+        if (arg == !!(bdev->bd_inode->i_flags & S_DAX))
+                return 0;
+        if (arg)
+                arg = S_DAX;
+        if (arg && !blkdev_dax_capable(bdev))
+                return -ENOTTY;
+        mutex_lock(&bdev->bd_inode->i_mutex);
+        if (bdev->bd_map_count == 0)
+                inode_set_flags(bdev->bd_inode, arg, S_DAX);
+        else
+                rc = -EBUSY;
+        mutex_unlock(&bdev->bd_inode->i_mutex);
+        return rc;
+}
+#else
+static int blkdev_daxset(struct block_device *bdev, int arg)
+{
+        if (arg)
+                return -ENOTTY;
+        return 0;
+}
+#endif
 static int blkdev_flushbuf(struct block_device *bdev, fmode_t mode,
                unsigned cmd, unsigned long arg)
 {
@@ -568,6 +634,11 @@ int blkdev_ioctl(struct block_device *bdev, fmode_t mode, unsigned cmd,
        case BLKTRACESETUP:
        case BLKTRACETEARDOWN:
                return blk_trace_ioctl(bdev, cmd, argp);
+        case BLKDAXSET:
+                return blkdev_daxset(bdev, arg);
+        case BLKDAXGET:
+                return put_int(arg, !!(bdev->bd_inode->i_flags & S_DAX));
+                break;
        case IOC_PR_REGISTER:
                return blkdev_pr_register(bdev, argp);
        case IOC_PR_RESERVE:
diff --git a/drivers/acpi/nfit.c b/drivers/acpi/nfit.c
index e7ed39bab97d..e1dbc8da09b7 100644
--- a/drivers/acpi/nfit.c
+++ b/drivers/acpi/nfit.c
@@ -15,6 +15,7 @@
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/ndctl.h>
+#include <linux/delay.h>
 #include <linux/list.h>
 #include <linux/acpi.h>
 #include <linux/sort.h>
@@ -1473,6 +1474,201 @@ static void acpi_nfit_blk_region_disable(struct nvdimm_bus *nvdimm_bus,
        /* devm will free nfit_blk */
 }
+static int ars_get_cap(struct nvdimm_bus_descriptor *nd_desc,
+                struct nd_cmd_ars_cap *cmd, u64 addr, u64 length)
+{
+        cmd->address = addr;
+        cmd->length = length;
+        return nd_desc->ndctl(nd_desc, NULL, ND_CMD_ARS_CAP, cmd,
+                        sizeof(*cmd));
+}
+static int ars_do_start(struct nvdimm_bus_descriptor *nd_desc,
+                struct nd_cmd_ars_start *cmd, u64 addr, u64 length)
+{
+        int rc;
+        cmd->address = addr;
+        cmd->length = length;
+        cmd->type = ND_ARS_PERSISTENT;
+        while (1) {
+                rc = nd_desc->ndctl(nd_desc, NULL, ND_CMD_ARS_START, cmd,
+                                sizeof(*cmd));
+                if (rc)
+                        return rc;
+                switch (cmd->status) {
+                case 0:
+                        return 0;
+                case 1:
+                        /* ARS unsupported, but we should never get here */
+                        return 0;
+                case 2:
+                        return -EINVAL;
+                case 3:
+                        /* ARS is in progress */
+                        msleep(1000);
+                        break;
+                default:
+                        return -ENXIO;
+                }
+        }
+}
+static int ars_get_status(struct nvdimm_bus_descriptor *nd_desc,
+                struct nd_cmd_ars_status *cmd)
+{
+        int rc;
+        while (1) {
+                rc = nd_desc->ndctl(nd_desc, NULL, ND_CMD_ARS_STATUS, cmd,
+                        sizeof(*cmd));
+                if (rc || cmd->status & 0xffff)
+                        return -ENXIO;
+                /* Check extended status (Upper two bytes) */
+                switch (cmd->status >> 16) {
+                case 0:
+                        return 0;
+                case 1:
+                        /* ARS is in progress */
+                        msleep(1000);
+                        break;
+                case 2:
+                        /* No ARS performed for the current boot */
+                        return 0;
+                default:
+                        return -ENXIO;
+                }
+        }
+}
+static int ars_status_process_records(struct nvdimm_bus *nvdimm_bus,
+                struct nd_cmd_ars_status *ars_status, u64 start)
+{
+        int rc;
+        u32 i;
+        /*
+         * The address field returned by ars_status should be either
+         * less than or equal to the address we last started ARS for.
+         * The (start, length) returned by ars_status should also have
+         * non-zero overlap with the range we started ARS for.
+         * If this is not the case, bail.
+         */
+        if (ars_status->address > start ||
+                        (ars_status->address + ars_status->length < start))
+                return -ENXIO;
+        for (i = 0; i < ars_status->num_records; i++) {
+                rc = nvdimm_bus_add_poison(nvdimm_bus,
+                                ars_status->records[i].err_address,
+                                ars_status->records[i].length);
+                if (rc)
+                        return rc;
+        }
+        return 0;
+}
+static int acpi_nfit_find_poison(struct acpi_nfit_desc *acpi_desc,
+                struct nd_region_desc *ndr_desc)
+{
+        struct nvdimm_bus_descriptor *nd_desc = &acpi_desc->nd_desc;
+        struct nvdimm_bus *nvdimm_bus = acpi_desc->nvdimm_bus;
+        struct nd_cmd_ars_status *ars_status = NULL;
+        struct nd_cmd_ars_start *ars_start = NULL;
+        struct nd_cmd_ars_cap *ars_cap = NULL;
+        u64 start, len, cur, remaining;
+        int rc;
+        ars_cap = kzalloc(sizeof(*ars_cap), GFP_KERNEL);
+        if (!ars_cap)
+                return -ENOMEM;
+        start = ndr_desc->res->start;
+        len = ndr_desc->res->end - ndr_desc->res->start + 1;
+        rc = ars_get_cap(nd_desc, ars_cap, start, len);
+        if (rc)
+                goto out;
+        /*
+         * If ARS is unsupported, or if the 'Persistent Memory Scrub' flag in
+         * extended status is not set, skip this but continue initialization
+         */
+        if ((ars_cap->status & 0xffff) ||
+                !(ars_cap->status >> 16 & ND_ARS_PERSISTENT)) {
+                dev_warn(acpi_desc->dev,
+                        "ARS unsupported (status: 0x%x), won't create an error list\n",
+                        ars_cap->status);
+                goto out;
+        }
+        /*
+         * Check if a full-range ARS has been run. If so, use those results
+         * without having to start a new ARS.
+         */
+        ars_status = kzalloc(ars_cap->max_ars_out + sizeof(*ars_status),
+                        GFP_KERNEL);
+        if (!ars_status) {
+                rc = -ENOMEM;
+                goto out;
+        }
+        rc = ars_get_status(nd_desc, ars_status);
+        if (rc)
+                goto out;
+        if (ars_status->address <= start &&
+                (ars_status->address + ars_status->length >= start + len)) {
+                rc = ars_status_process_records(nvdimm_bus, ars_status, start);
+                goto out;
+        }
+        /*
+         * ARS_STATUS can overflow if the number of poison entries found is
+         * greater than the maximum buffer size (ars_cap->max_ars_out)
+         * To detect overflow, check if the length field of ars_status
+         * is less than the length we supplied. If so, process the
+         * error entries we got, adjust the start point, and start again
+         */
+        ars_start = kzalloc(sizeof(*ars_start), GFP_KERNEL);
+        if (!ars_start)
+                return -ENOMEM;
+        cur = start;
+        remaining = len;
+        do {
+                u64 done, end;
+                rc = ars_do_start(nd_desc, ars_start, cur, remaining);
+                if (rc)
+                        goto out;
+                rc = ars_get_status(nd_desc, ars_status);
+                if (rc)
+                        goto out;
+                rc = ars_status_process_records(nvdimm_bus, ars_status, cur);
+                if (rc)
+                        goto out;
+                end = min(cur + remaining,
+                        ars_status->address + ars_status->length);
+                done = end - cur;
+                cur += done;
+                remaining -= done;
+        } while (remaining);
+ out:
+        kfree(ars_cap);
+        kfree(ars_start);
+        kfree(ars_status);
+        return rc;
+}
 static int acpi_nfit_init_mapping(struct acpi_nfit_desc *acpi_desc,
                struct nd_mapping *nd_mapping, struct nd_region_desc *ndr_desc,
                struct acpi_nfit_memory_map *memdev,
@@ -1585,6 +1781,13 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
        nvdimm_bus = acpi_desc->nvdimm_bus;
        if (nfit_spa_type(spa) == NFIT_SPA_PM) {
+                rc = acpi_nfit_find_poison(acpi_desc, ndr_desc);
+                if (rc) {
+                        dev_err(acpi_desc->dev,
+                                "error while performing ARS to find poison: %d\n",
+                                rc);
+                        return rc;
+                }
                if (!nvdimm_pmem_region_create(nvdimm_bus, ndr_desc))
                        return -ENOMEM;
        } else if (nfit_spa_type(spa) == NFIT_SPA_VOLATILE) {
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index ff02bb4218fc..cdfbcc54821f 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -314,16 +314,6 @@ static const struct pci_device_id ahci_pci_tbl[] = {
        { PCI_VDEVICE(INTEL, 0x1f37), board_ahci_avn }, /* Avoton RAID */
        { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci_avn }, /* Avoton RAID */
        { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci_avn }, /* Avoton RAID */
-        { PCI_VDEVICE(INTEL, 0xa182), board_ahci }, /* Lewisburg AHCI*/
-        { PCI_VDEVICE(INTEL, 0xa202), board_ahci }, /* Lewisburg AHCI*/
-        { PCI_VDEVICE(INTEL, 0xa184), board_ahci }, /* Lewisburg RAID*/
-        { PCI_VDEVICE(INTEL, 0xa204), board_ahci }, /* Lewisburg RAID*/
-        { PCI_VDEVICE(INTEL, 0xa186), board_ahci }, /* Lewisburg RAID*/
-        { PCI_VDEVICE(INTEL, 0xa206), board_ahci }, /* Lewisburg RAID*/
-        { PCI_VDEVICE(INTEL, 0x2822), board_ahci }, /* Lewisburg RAID*/
-        { PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* Lewisburg RAID*/
-        { PCI_VDEVICE(INTEL, 0xa18e), board_ahci }, /* Lewisburg RAID*/
-        { PCI_VDEVICE(INTEL, 0xa20e), board_ahci }, /* Lewisburg RAID*/
        { PCI_VDEVICE(INTEL, 0x2823), board_ahci }, /* Wellsburg RAID */
        { PCI_VDEVICE(INTEL, 0x2827), board_ahci }, /* Wellsburg RAID */
        { PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */
@@ -350,10 +340,22 @@ static const struct pci_device_id ahci_pci_tbl[] = {
        { PCI_VDEVICE(INTEL, 0x9d03), board_ahci }, /* Sunrise Point-LP AHCI */
        { PCI_VDEVICE(INTEL, 0x9d05), board_ahci }, /* Sunrise Point-LP RAID */
        { PCI_VDEVICE(INTEL, 0x9d07), board_ahci }, /* Sunrise Point-LP RAID */
+        { PCI_VDEVICE(INTEL, 0xa102), board_ahci }, /* Sunrise Point-H AHCI */
        { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */
        { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */
+        { PCI_VDEVICE(INTEL, 0xa106), board_ahci }, /* Sunrise Point-H RAID */
        { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */
        { PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */
+        { PCI_VDEVICE(INTEL, 0x2822), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa182), board_ahci }, /* Lewisburg AHCI*/
+        { PCI_VDEVICE(INTEL, 0xa184), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa186), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa18e), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa202), board_ahci }, /* Lewisburg AHCI*/
+        { PCI_VDEVICE(INTEL, 0xa204), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa206), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa20e), board_ahci }, /* Lewisburg RAID*/
        /* JMicron 360/1/3/5/6, match class to avoid IDE function */
        { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
diff --git a/drivers/ata/ahci_mvebu.c b/drivers/ata/ahci_mvebu.c
index 8490d37aee2a..f7a7fa81740e 100644
--- a/drivers/ata/ahci_mvebu.c
+++ b/drivers/ata/ahci_mvebu.c
@@ -62,6 +62,7 @@ static void ahci_mvebu_regret_option(struct ahci_host_priv *hpriv)
        writel(0x80, hpriv->mmio + AHCI_VENDOR_SPECIFIC_0_DATA);
 }
+#ifdef CONFIG_PM_SLEEP
 static int ahci_mvebu_suspend(struct platform_device *pdev, pm_message_t state)
 {
        return ahci_platform_suspend_host(&pdev->dev);
@@ -81,6 +82,10 @@ static int ahci_mvebu_resume(struct platform_device *pdev)
        return ahci_platform_resume_host(&pdev->dev);
 }
+#else
+#define ahci_mvebu_suspend NULL
+#define ahci_mvebu_resume NULL
+#endif
 static const struct ata_port_info ahci_mvebu_port_info = {
        .flags     = AHCI_FLAG_COMMON,
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 096064cd6c52..4665512dae44 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -1273,6 +1273,15 @@ static int ahci_exec_polled_cmd(struct ata_port *ap, int pmp,
        ata_tf_to_fis(tf, pmp, is_cmd, fis);
        ahci_fill_cmd_slot(pp, 0, cmd_fis_len | flags | (pmp << 12));
+        /* set port value for softreset of Port Multiplier */
+        if (pp->fbs_enabled && pp->fbs_last_dev != pmp) {
+                tmp = readl(port_mmio + PORT_FBS);
+                tmp &= ~(PORT_FBS_DEV_MASK | PORT_FBS_DEC);
+                tmp |= pmp << PORT_FBS_DEV_OFFSET;
+                writel(tmp, port_mmio + PORT_FBS);
+                pp->fbs_last_dev = pmp;
+        }
        /* issue & wait */
        writel(1, port_mmio + PORT_CMD_ISSUE);
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index cb0508af1459..961acc788f44 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1505,12 +1505,20 @@ static const char *ata_err_string(unsigned int err_mask)
 unsigned int ata_read_log_page(struct ata_device *dev, u8 log,
                               u8 page, void *buf, unsigned int sectors)
 {
+        unsigned long ap_flags = dev->link->ap->flags;
        struct ata_taskfile tf;
        unsigned int err_mask;
        bool dma = false;
        DPRINTK("read log page - log 0x%x, page 0x%x\n", log, page);
+        /*
+         * Return error without actually issuing the command on controllers
+         * which e.g. lockup on a read log page.
+         */
+        if (ap_flags & ATA_FLAG_NO_LOG_PAGE)
+                return AC_ERR_DEV;
 retry:
        ata_tf_init(dev, &tf);
        if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) &&
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index 5389579c5120..a723ae929783 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -45,7 +45,8 @@ enum {
        SATA_FSL_MAX_PRD_DIRECT = 16,   /* Direct PRDT entries */
        SATA_FSL_HOST_FLAGS     = (ATA_FLAG_SATA | ATA_FLAG_PIO_DMA |
-                                ATA_FLAG_PMP | ATA_FLAG_NCQ | ATA_FLAG_AN),
+                                   ATA_FLAG_PMP | ATA_FLAG_NCQ |
+                                   ATA_FLAG_AN | ATA_FLAG_NO_LOG_PAGE),
        SATA_FSL_MAX_CMDS       = SATA_FSL_QUEUE_DEPTH,
        SATA_FSL_CMD_HDR_SIZE   = 16,   /* 4 DWORDS */
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index dea6edcbf145..29bcff086bce 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -630,6 +630,9 @@ static void sil_dev_config(struct ata_device *dev)
        unsigned int n, quirks = 0;
        unsigned char model_num[ATA_ID_PROD_LEN + 1];
+        /* This controller doesn't support trim */
+        dev->horkage |= ATA_HORKAGE_NOTRIM;
        ata_id_c_string(dev->id, model_num, ATA_ID_PROD, sizeof(model_num));
        for (n = 0; sil_blacklist[n].product; n++)
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 2804aed3f416..25425d3f2575 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -303,6 +303,10 @@ static int memory_subsys_offline(struct device *dev)
        if (mem->state == MEM_OFFLINE)
                return 0;
+        /* Can't offline block with non-present sections */
+        if (mem->section_count != sections_per_block)
+                return -EINVAL;
        return memory_block_change_state(mem, MEM_OFFLINE, MEM_ONLINE);
 }
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 0c3940ec5e62..8162475d96b5 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -444,8 +444,9 @@ static void null_lnvm_end_io(struct request *rq, int error)
        blk_put_request(rq);
 }
-static int null_lnvm_submit_io(struct request_queue *q, struct nvm_rq *rqd)
+static int null_lnvm_submit_io(struct nvm_dev *dev, struct nvm_rq *rqd)
 {
+        struct request_queue *q = dev->q;
        struct request *rq;
        struct bio *bio = rqd->bio;
@@ -470,7 +471,7 @@ static int null_lnvm_submit_io(struct request_queue *q, struct nvm_rq *rqd)
        return 0;
 }
-static int null_lnvm_id(struct request_queue *q, struct nvm_id *id)
+static int null_lnvm_id(struct nvm_dev *dev, struct nvm_id *id)
 {
        sector_t size = gb * 1024 * 1024 * 1024ULL;
        sector_t blksize;
@@ -523,7 +524,7 @@ static int null_lnvm_id(struct request_queue *q, struct nvm_id *id)
        return 0;
 }
-static void *null_lnvm_create_dma_pool(struct request_queue *q, char *name)
+static void *null_lnvm_create_dma_pool(struct nvm_dev *dev, char *name)
 {
        mempool_t *virtmem_pool;
@@ -541,7 +542,7 @@ static void null_lnvm_destroy_dma_pool(void *pool)
        mempool_destroy(pool);
 }
-static void *null_lnvm_dev_dma_alloc(struct request_queue *q, void *pool,
+static void *null_lnvm_dev_dma_alloc(struct nvm_dev *dev, void *pool,
                                gfp_t mem_flags, dma_addr_t *dma_handler)
 {
        return mempool_alloc(pool, mem_flags);
@@ -765,7 +766,9 @@ out:
 static int __init null_init(void)
 {
+        int ret = 0;
        unsigned int i;
+        struct nullb *nullb;
        if (bs > PAGE_SIZE) {
                pr_warn("null_blk: invalid block size\n");
@@ -807,22 +810,29 @@ static int __init null_init(void)
                                                                0, 0, NULL);
                if (!ppa_cache) {
                        pr_err("null_blk: unable to create ppa cache\n");
-                        return -ENOMEM;
+                        ret = -ENOMEM;
+                        goto err_ppa;
                }
        }
        for (i = 0; i < nr_devices; i++) {
-                if (null_add_dev()) {
+                ret = null_add_dev();
-                        unregister_blkdev(null_major, "nullb");
+                if (ret)
-                        goto err_ppa;
+                        goto err_dev;
-                }
        }
        pr_info("null: module loaded\n");
        return 0;
-err_ppa:
+err_dev:
+        while (!list_empty(&nullb_list)) {
+                nullb = list_entry(nullb_list.next, struct nullb, list);
+                null_del_dev(nullb);
+        }
        kmem_cache_destroy(ppa_cache);
-        return -EINVAL;
+err_ppa:
+        unregister_blkdev(null_major, "nullb");
+        return ret;
 }
 static void __exit null_exit(void)
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 55fe9020459f..4cc72fa017c7 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -1230,14 +1230,14 @@ static int smi_start_processing(void       *send_info,
        new_smi->intf = intf;
-        /* Try to claim any interrupts. */
-        if (new_smi->irq_setup)
-                new_smi->irq_setup(new_smi);
        /* Set up the timer that drives the interface. */
        setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
        smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
+        /* Try to claim any interrupts. */
+        if (new_smi->irq_setup)
+                new_smi->irq_setup(new_smi);
        /*
         * Check if the user forcefully enabled the daemon.
         */
diff --git a/drivers/clk/clk-gpio.c b/drivers/clk/clk-gpio.c
index 10819e248414..335322dc403f 100644
--- a/drivers/clk/clk-gpio.c
+++ b/drivers/clk/clk-gpio.c
@@ -209,6 +209,8 @@ EXPORT_SYMBOL_GPL(clk_register_gpio_mux);
 struct clk_gpio_delayed_register_data {
        const char *gpio_name;
+        int num_parents;
+        const char **parent_names;
        struct device_node *node;
        struct mutex lock;
        struct clk *clk;
@@ -222,8 +224,6 @@ static struct clk *of_clk_gpio_delayed_register_get(
 {
        struct clk_gpio_delayed_register_data *data = _data;
        struct clk *clk;
-        const char **parent_names;
-        int i, num_parents;
        int gpio;
        enum of_gpio_flags of_flags;
@@ -248,26 +248,14 @@ static struct clk *of_clk_gpio_delayed_register_get(
                return ERR_PTR(gpio);
        }
-        num_parents = of_clk_get_parent_count(data->node);
+        clk = data->clk_register_get(data->node->name, data->parent_names,
+                        data->num_parents, gpio, of_flags & OF_GPIO_ACTIVE_LOW);
-        parent_names = kcalloc(num_parents, sizeof(char *), GFP_KERNEL);
-        if (!parent_names) {
-                clk = ERR_PTR(-ENOMEM);
-                goto out;
-        }
-        for (i = 0; i < num_parents; i++)
-                parent_names[i] = of_clk_get_parent_name(data->node, i);
-        clk = data->clk_register_get(data->node->name, parent_names,
-                        num_parents, gpio, of_flags & OF_GPIO_ACTIVE_LOW);
        if (IS_ERR(clk))
                goto out;
        data->clk = clk;
 out:
        mutex_unlock(&data->lock);
-        kfree(parent_names);
        return clk;
 }
@@ -296,11 +284,24 @@ static void __init of_gpio_clk_setup(struct device_node *node,
                                unsigned gpio, bool active_low))
 {
        struct clk_gpio_delayed_register_data *data;
+        const char **parent_names;
+        int i, num_parents;
        data = kzalloc(sizeof(*data), GFP_KERNEL);
        if (!data)
                return;
+        num_parents = of_clk_get_parent_count(node);
+        parent_names = kcalloc(num_parents, sizeof(char *), GFP_KERNEL);
+        if (!parent_names)
+                return;
+        for (i = 0; i < num_parents; i++)
+                parent_names[i] = of_clk_get_parent_name(node, i);
+        data->num_parents = num_parents;
+        data->parent_names = parent_names;
        data->node = node;
        data->gpio_name = gpio_name;
        data->clk_register_get = clk_register_get;
diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
index 1ab0fb81c6a0..7bc1c4527ae4 100644
--- a/drivers/clk/clk-qoriq.c
+++ b/drivers/clk/clk-qoriq.c
@@ -778,8 +778,10 @@ static struct clk * __init create_one_cmux(struct clockgen *cg, int idx)
         */
        clksel = (cg_in(cg, hwc->reg) & CLKSEL_MASK) >> CLKSEL_SHIFT;
        div = get_pll_div(cg, hwc, clksel);
-        if (!div)
+        if (!div) {
+                kfree(hwc);
                return NULL;
+        }
        pct80_rate = clk_get_rate(div->clk);
        pct80_rate *= 8;
diff --git a/drivers/clk/clk-scpi.c b/drivers/clk/clk-scpi.c
index 0b501a9fef92..cd0f2726f5e0 100644
--- a/drivers/clk/clk-scpi.c
+++ b/drivers/clk/clk-scpi.c
@@ -292,6 +292,7 @@ static int scpi_clocks_probe(struct platform_device *pdev)
                ret = scpi_clk_add(dev, child, match);
                if (ret) {
                        scpi_clocks_remove(pdev);
+                        of_node_put(child);
                        return ret;
                }
        }
diff --git a/drivers/clk/imx/clk-pllv1.c b/drivers/clk/imx/clk-pllv1.c
index 8564e4342c7d..82fe3662b5f6 100644
--- a/drivers/clk/imx/clk-pllv1.c
+++ b/drivers/clk/imx/clk-pllv1.c
@@ -52,7 +52,7 @@ static unsigned long clk_pllv1_recalc_rate(struct clk_hw *hw,
                unsigned long parent_rate)
 {
        struct clk_pllv1 *pll = to_clk_pllv1(hw);
-        long long ll;
+        unsigned long long ull;
        int mfn_abs;
        unsigned int mfi, mfn, mfd, pd;
        u32 reg;
@@ -94,16 +94,16 @@ static unsigned long clk_pllv1_recalc_rate(struct clk_hw *hw,
        rate = parent_rate * 2;
        rate /= pd + 1;
-        ll = (unsigned long long)rate * mfn_abs;
+        ull = (unsigned long long)rate * mfn_abs;
-        do_div(ll, mfd + 1);
+        do_div(ull, mfd + 1);
        if (mfn_is_negative(pll, mfn))
-                ll = -ll;
+                ull = (rate * mfi) - ull;
+        else
+                ull = (rate * mfi) + ull;
-        ll = (rate * mfi) + ll;
+        return ull;
-        return ll;
 }
 static struct clk_ops clk_pllv1_ops = {
diff --git a/drivers/clk/imx/clk-pllv2.c b/drivers/clk/imx/clk-pllv2.c
index b18f875eac6a..4aeda56ce372 100644
--- a/drivers/clk/imx/clk-pllv2.c
+++ b/drivers/clk/imx/clk-pllv2.c
@@ -79,7 +79,7 @@ static unsigned long __clk_pllv2_recalc_rate(unsigned long parent_rate,
 {
        long mfi, mfn, mfd, pdf, ref_clk;
        unsigned long dbl;
-        s64 temp;
+        u64 temp;
        dbl = dp_ctl & MXC_PLL_DP_CTL_DPDCK0_2_EN;
@@ -98,8 +98,9 @@ static unsigned long __clk_pllv2_recalc_rate(unsigned long parent_rate,
        temp = (u64) ref_clk * abs(mfn);
        do_div(temp, mfd + 1);
        if (mfn < 0)
-                temp = -temp;
+                temp = (ref_clk * mfi) - temp;
-        temp = (ref_clk * mfi) + temp;
+        else
+                temp = (ref_clk * mfi) + temp;
        return temp;
 }
@@ -126,7 +127,7 @@ static int __clk_pllv2_set_rate(unsigned long rate, unsigned long parent_rate,
 {
        u32 reg;
        long mfi, pdf, mfn, mfd = 999999;
-        s64 temp64;
+        u64 temp64;
        unsigned long quad_parent_rate;
        quad_parent_rate = 4 * parent_rate;
diff --git a/drivers/clk/imx/clk-vf610.c b/drivers/clk/imx/clk-vf610.c
index d1b1c95177bb..0a94d9661d91 100644
--- a/drivers/clk/imx/clk-vf610.c
+++ b/drivers/clk/imx/clk-vf610.c
@@ -335,22 +335,22 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
        clk[VF610_CLK_SAI0_SEL] = imx_clk_mux("sai0_sel", CCM_CSCMR1, 0, 2, sai_sels, 4);
        clk[VF610_CLK_SAI0_EN] = imx_clk_gate("sai0_en", "sai0_sel", CCM_CSCDR1, 16);
        clk[VF610_CLK_SAI0_DIV] = imx_clk_divider("sai0_div", "sai0_en", CCM_CSCDR1, 0, 4);
-        clk[VF610_CLK_SAI0] = imx_clk_gate2("sai0", "sai0_div", CCM_CCGR0, CCM_CCGRx_CGn(15));
+        clk[VF610_CLK_SAI0] = imx_clk_gate2("sai0", "ipg_bus", CCM_CCGR0, CCM_CCGRx_CGn(15));
        clk[VF610_CLK_SAI1_SEL] = imx_clk_mux("sai1_sel", CCM_CSCMR1, 2, 2, sai_sels, 4);
        clk[VF610_CLK_SAI1_EN] = imx_clk_gate("sai1_en", "sai1_sel", CCM_CSCDR1, 17);
        clk[VF610_CLK_SAI1_DIV] = imx_clk_divider("sai1_div", "sai1_en", CCM_CSCDR1, 4, 4);
-        clk[VF610_CLK_SAI1] = imx_clk_gate2("sai1", "sai1_div", CCM_CCGR1, CCM_CCGRx_CGn(0));
+        clk[VF610_CLK_SAI1] = imx_clk_gate2("sai1", "ipg_bus", CCM_CCGR1, CCM_CCGRx_CGn(0));
        clk[VF610_CLK_SAI2_SEL] = imx_clk_mux("sai2_sel", CCM_CSCMR1, 4, 2, sai_sels, 4);
        clk[VF610_CLK_SAI2_EN] = imx_clk_gate("sai2_en", "sai2_sel", CCM_CSCDR1, 18);
        clk[VF610_CLK_SAI2_DIV] = imx_clk_divider("sai2_div", "sai2_en", CCM_CSCDR1, 8, 4);
-        clk[VF610_CLK_SAI2] = imx_clk_gate2("sai2", "sai2_div", CCM_CCGR1, CCM_CCGRx_CGn(1));
+        clk[VF610_CLK_SAI2] = imx_clk_gate2("sai2", "ipg_bus", CCM_CCGR1, CCM_CCGRx_CGn(1));
        clk[VF610_CLK_SAI3_SEL] = imx_clk_mux("sai3_sel", CCM_CSCMR1, 6, 2, sai_sels, 4);
        clk[VF610_CLK_SAI3_EN] = imx_clk_gate("sai3_en", "sai3_sel", CCM_CSCDR1, 19);
        clk[VF610_CLK_SAI3_DIV] = imx_clk_divider("sai3_div", "sai3_en", CCM_CSCDR1, 12, 4);
-        clk[VF610_CLK_SAI3] = imx_clk_gate2("sai3", "sai3_div", CCM_CCGR1, CCM_CCGRx_CGn(2));
+        clk[VF610_CLK_SAI3] = imx_clk_gate2("sai3", "ipg_bus", CCM_CCGR1, CCM_CCGRx_CGn(2));
        clk[VF610_CLK_NFC_SEL] = imx_clk_mux("nfc_sel", CCM_CSCMR1, 12, 2, nfc_sels, 4);
        clk[VF610_CLK_NFC_EN] = imx_clk_gate("nfc_en", "nfc_sel", CCM_CSCDR2, 9);
diff --git a/drivers/clk/mmp/clk-mmp2.c b/drivers/clk/mmp/clk-mmp2.c
index 09d2832fbd78..71fd29348f28 100644
--- a/drivers/clk/mmp/clk-mmp2.c
+++ b/drivers/clk/mmp/clk-mmp2.c
@@ -9,6 +9,7 @@
 * warranty of any kind, whether express or implied.
 */
+#include <linux/clk.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/spinlock.h>
diff --git a/drivers/clk/mmp/clk-pxa168.c b/drivers/clk/mmp/clk-pxa168.c
index 93e967c0f972..75244915df05 100644
--- a/drivers/clk/mmp/clk-pxa168.c
+++ b/drivers/clk/mmp/clk-pxa168.c
@@ -9,6 +9,7 @@
 * warranty of any kind, whether express or implied.
 */
+#include <linux/clk.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/spinlock.h>
diff --git a/drivers/clk/mmp/clk-pxa910.c b/drivers/clk/mmp/clk-pxa910.c
index 993abcdb32cc..37ba04ba1368 100644
--- a/drivers/clk/mmp/clk-pxa910.c
+++ b/drivers/clk/mmp/clk-pxa910.c
@@ -9,6 +9,7 @@
 * warranty of any kind, whether express or implied.
 */
+#include <linux/clk.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/spinlock.h>
diff --git a/drivers/clk/sunxi/clk-a10-pll2.c b/drivers/clk/sunxi/clk-a10-pll2.c
index 5484c31ec568..0ee1f363e4be 100644
--- a/drivers/clk/sunxi/clk-a10-pll2.c
+++ b/drivers/clk/sunxi/clk-a10-pll2.c
@@ -41,15 +41,10 @@
 #define SUN4I_PLL2_OUTPUTS              4
-struct sun4i_pll2_data {
-        u32     post_div_offset;
-        u32     pre_div_flags;
-};
 static DEFINE_SPINLOCK(sun4i_a10_pll2_lock);
 static void __init sun4i_pll2_setup(struct device_node *node,
-                                    struct sun4i_pll2_data *data)
+                                    int post_div_offset)
 {
        const char *clk_name = node->name, *parent;
        struct clk **clks, *base_clk, *prediv_clk;
@@ -76,7 +71,7 @@ static void __init sun4i_pll2_setup(struct device_node *node,
                                          parent, 0, reg,
                                          SUN4I_PLL2_PRE_DIV_SHIFT,
                                          SUN4I_PLL2_PRE_DIV_WIDTH,
-                                          data->pre_div_flags,
+                                          CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
                                          &sun4i_a10_pll2_lock);
        if (!prediv_clk) {
                pr_err("Couldn't register the prediv clock\n");
@@ -127,7 +122,7 @@ static void __init sun4i_pll2_setup(struct device_node *node,
         */
        val = readl(reg);
        val &= ~(SUN4I_PLL2_POST_DIV_MASK << SUN4I_PLL2_POST_DIV_SHIFT);
-        val |= (SUN4I_PLL2_POST_DIV_VALUE - data->post_div_offset) << SUN4I_PLL2_POST_DIV_SHIFT;
+        val |= (SUN4I_PLL2_POST_DIV_VALUE - post_div_offset) << SUN4I_PLL2_POST_DIV_SHIFT;
        writel(val, reg);
        of_property_read_string_index(node, "clock-output-names",
@@ -191,25 +186,17 @@ err_unmap:
        iounmap(reg);
 }
-static struct sun4i_pll2_data sun4i_a10_pll2_data = {
-        .pre_div_flags  = CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
-};
 static void __init sun4i_a10_pll2_setup(struct device_node *node)
 {
-        sun4i_pll2_setup(node, &sun4i_a10_pll2_data);
+        sun4i_pll2_setup(node, 0);
 }
 CLK_OF_DECLARE(sun4i_a10_pll2, "allwinner,sun4i-a10-pll2-clk",
               sun4i_a10_pll2_setup);
-static struct sun4i_pll2_data sun5i_a13_pll2_data = {
-        .post_div_offset        = 1,
-};
 static void __init sun5i_a13_pll2_setup(struct device_node *node)
 {
-        sun4i_pll2_setup(node, &sun5i_a13_pll2_data);
+        sun4i_pll2_setup(node, 1);
 }
 CLK_OF_DECLARE(sun5i_a13_pll2, "allwinner,sun5i-a13-pll2-clk",
diff --git a/drivers/clk/ti/clk-816x.c b/drivers/clk/ti/clk-816x.c
index 1dfad0c712cd..2a5d84fdddc5 100644
--- a/drivers/clk/ti/clk-816x.c
+++ b/drivers/clk/ti/clk-816x.c
@@ -20,6 +20,8 @@ static struct ti_dt_clk dm816x_clks[] = {
        DT_CLK(NULL, "sys_clkin", "sys_clkin_ck"),
        DT_CLK(NULL, "timer_sys_ck", "sys_clkin_ck"),
        DT_CLK(NULL, "sys_32k_ck", "sys_32k_ck"),
+        DT_CLK(NULL, "timer_32k_ck", "sysclk18_ck"),
+        DT_CLK(NULL, "timer_ext_ck", "tclkin_ck"),
        DT_CLK(NULL, "mpu_ck", "mpu_ck"),
        DT_CLK(NULL, "timer1_fck", "timer1_fck"),
        DT_CLK(NULL, "timer2_fck", "timer2_fck"),
diff --git a/drivers/clk/ti/clkt_dpll.c b/drivers/clk/ti/clkt_dpll.c
index 9023ca9caf84..b5cc6f66ae5d 100644
--- a/drivers/clk/ti/clkt_dpll.c
+++ b/drivers/clk/ti/clkt_dpll.c
@@ -240,7 +240,7 @@ u8 omap2_init_dpll_parent(struct clk_hw *hw)
 */
 unsigned long omap2_get_dpll_rate(struct clk_hw_omap *clk)
 {
-        long long dpll_clk;
+        u64 dpll_clk;
        u32 dpll_mult, dpll_div, v;
        struct dpll_data *dd;
@@ -262,7 +262,7 @@ unsigned long omap2_get_dpll_rate(struct clk_hw_omap *clk)
        dpll_div = v & dd->div1_mask;
        dpll_div >>= __ffs(dd->div1_mask);
-        dpll_clk = (long long)clk_get_rate(dd->clk_ref) * dpll_mult;
+        dpll_clk = (u64)clk_get_rate(dd->clk_ref) * dpll_mult;
        do_div(dpll_clk, dpll_div + 1);
        return dpll_clk;
diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c
index 5b1726829e6d..df2558350fc1 100644
--- a/drivers/clk/ti/divider.c
+++ b/drivers/clk/ti/divider.c
@@ -214,7 +214,6 @@ static int ti_clk_divider_set_rate(struct clk_hw *hw, unsigned long rate,
 {
        struct clk_divider *divider;
        unsigned int div, value;
-        unsigned long flags = 0;
        u32 val;
        if (!hw || !rate)
@@ -228,9 +227,6 @@ static int ti_clk_divider_set_rate(struct clk_hw *hw, unsigned long rate,
        if (value > div_mask(divider))
                value = div_mask(divider);
-        if (divider->lock)
-                spin_lock_irqsave(divider->lock, flags);
        if (divider->flags & CLK_DIVIDER_HIWORD_MASK) {
                val = div_mask(divider) << (divider->shift + 16);
        } else {
@@ -240,9 +236,6 @@ static int ti_clk_divider_set_rate(struct clk_hw *hw, unsigned long rate,
        val |= value << divider->shift;
        ti_clk_ll_ops->clk_writel(val, divider->reg);
-        if (divider->lock)
-                spin_unlock_irqrestore(divider->lock, flags);
        return 0;
 }
@@ -256,8 +249,7 @@ static struct clk *_register_divider(struct device *dev, const char *name,
                                     const char *parent_name,
                                     unsigned long flags, void __iomem *reg,
                                     u8 shift, u8 width, u8 clk_divider_flags,
-                                     const struct clk_div_table *table,
+                                     const struct clk_div_table *table)
-                                     spinlock_t *lock)
 {
        struct clk_divider *div;
        struct clk *clk;
@@ -288,7 +280,6 @@ static struct clk *_register_divider(struct device *dev, const char *name,
        div->shift = shift;
        div->width = width;
        div->flags = clk_divider_flags;
-        div->lock = lock;
        div->hw.init = &init;
        div->table = table;
@@ -421,7 +412,7 @@ struct clk *ti_clk_register_divider(struct ti_clk *setup)
        clk = _register_divider(NULL, setup->name, div->parent,
                                flags, (void __iomem *)reg, div->bit_shift,
-                                width, div_flags, table, NULL);
+                                width, div_flags, table);
        if (IS_ERR(clk))
                kfree(table);
@@ -584,8 +575,7 @@ static void __init of_ti_divider_clk_setup(struct device_node *node)
                goto cleanup;
        clk = _register_divider(NULL, node->name, parent_name, flags, reg,
-                                shift, width, clk_divider_flags, table,
+                                shift, width, clk_divider_flags, table);
-                                NULL);
        if (!IS_ERR(clk)) {
                of_clk_add_provider(node, of_clk_src_simple_get, clk);
diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c
index f4b2e9888bdf..66a0d0ed8b55 100644
--- a/drivers/clk/ti/fapll.c
+++ b/drivers/clk/ti/fapll.c
@@ -168,7 +168,7 @@ static unsigned long ti_fapll_recalc_rate(struct clk_hw *hw,
 {
        struct fapll_data *fd = to_fapll(hw);
        u32 fapll_n, fapll_p, v;
-        long long rate;
+        u64 rate;
        if (ti_fapll_clock_is_bypass(fd))
                return parent_rate;
@@ -314,7 +314,7 @@ static unsigned long ti_fapll_synth_recalc_rate(struct clk_hw *hw,
 {
        struct fapll_synth *synth = to_synth(hw);
        u32 synth_div_m;
-        long long rate;
+        u64 rate;
        /* The audio_pll_clk1 is hardwired to produce 32.768KiHz clock */
        if (!synth->div)
diff --git a/drivers/clk/ti/mux.c b/drivers/clk/ti/mux.c
index 69f08a1d047d..dab9ba88b9d6 100644
--- a/drivers/clk/ti/mux.c
+++ b/drivers/clk/ti/mux.c
@@ -69,7 +69,6 @@ static int ti_clk_mux_set_parent(struct clk_hw *hw, u8 index)
 {
        struct clk_mux *mux = to_clk_mux(hw);
        u32 val;
-        unsigned long flags = 0;
        if (mux->table) {
                index = mux->table[index];
@@ -81,9 +80,6 @@ static int ti_clk_mux_set_parent(struct clk_hw *hw, u8 index)
                        index++;
        }
-        if (mux->lock)
-                spin_lock_irqsave(mux->lock, flags);
        if (mux->flags & CLK_MUX_HIWORD_MASK) {
                val = mux->mask << (mux->shift + 16);
        } else {
@@ -93,9 +89,6 @@ static int ti_clk_mux_set_parent(struct clk_hw *hw, u8 index)
        val |= index << mux->shift;
        ti_clk_ll_ops->clk_writel(val, mux->reg);
-        if (mux->lock)
-                spin_unlock_irqrestore(mux->lock, flags);
        return 0;
 }
@@ -109,7 +102,7 @@ static struct clk *_register_mux(struct device *dev, const char *name,
                                 const char **parent_names, u8 num_parents,
                                 unsigned long flags, void __iomem *reg,
                                 u8 shift, u32 mask, u8 clk_mux_flags,
-                                 u32 *table, spinlock_t *lock)
+                                 u32 *table)
 {
        struct clk_mux *mux;
        struct clk *clk;
@@ -133,7 +126,6 @@ static struct clk *_register_mux(struct device *dev, const char *name,
        mux->shift = shift;
        mux->mask = mask;
        mux->flags = clk_mux_flags;
-        mux->lock = lock;
        mux->table = table;
        mux->hw.init = &init;
@@ -175,7 +167,7 @@ struct clk *ti_clk_register_mux(struct ti_clk *setup)
        return _register_mux(NULL, setup->name, mux->parents, mux->num_parents,
                             flags, (void __iomem *)reg, mux->bit_shift, mask,
-                             mux_flags, NULL, NULL);
+                             mux_flags, NULL);
 }
 /**
@@ -227,8 +219,7 @@ static void of_mux_clk_setup(struct device_node *node)
        mask = (1 << fls(mask)) - 1;
        clk = _register_mux(NULL, node->name, parent_names, num_parents,
-                            flags, reg, shift, mask, clk_mux_flags, NULL,
+                            flags, reg, shift, mask, clk_mux_flags, NULL);
-                            NULL);
        if (!IS_ERR(clk))
                of_clk_add_provider(node, of_clk_src_simple_get, clk);
diff --git a/drivers/clocksource/mmio.c b/drivers/clocksource/mmio.c
index 1593ade2a815..c4f7d7a9b689 100644
--- a/drivers/clocksource/mmio.c
+++ b/drivers/clocksource/mmio.c
@@ -55,7 +55,7 @@ int __init clocksource_mmio_init(void __iomem *base, const char *name,
 {
        struct clocksource_mmio *cs;
-        if (bits > 32 || bits < 16)
+        if (bits > 64 || bits < 16)
                return -EINVAL;
        cs = kzalloc(sizeof(struct clocksource_mmio), GFP_KERNEL);
diff --git a/drivers/cpufreq/s3c24xx-cpufreq.c b/drivers/cpufreq/s3c24xx-cpufreq.c
index 733aa5153e74..68ef8fd9482f 100644
--- a/drivers/cpufreq/s3c24xx-cpufreq.c
+++ b/drivers/cpufreq/s3c24xx-cpufreq.c
@@ -648,7 +648,7 @@ late_initcall(s3c_cpufreq_initcall);
 *
 * Register the given set of PLLs with the system.
 */
-int __init s3c_plltab_register(struct cpufreq_frequency_table *plls,
+int s3c_plltab_register(struct cpufreq_frequency_table *plls,
                               unsigned int plls_no)
 {
        struct cpufreq_frequency_table *vals;
diff --git a/drivers/fpga/fpga-mgr.c b/drivers/fpga/fpga-mgr.c
index a24f5cb877e0..953dc9195937 100644
--- a/drivers/fpga/fpga-mgr.c
+++ b/drivers/fpga/fpga-mgr.c
@@ -122,12 +122,10 @@ int fpga_mgr_firmware_load(struct fpga_manager *mgr, u32 flags,
        }
        ret = fpga_mgr_buf_load(mgr, flags, fw->data, fw->size);
-        if (ret)
-                return ret;
        release_firmware(fw);
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(fpga_mgr_firmware_load);
@@ -256,7 +254,6 @@ int fpga_mgr_register(struct device *dev, const char *name,
                      void *priv)
 {
        struct fpga_manager *mgr;
-        const char *dt_label;
        int id, ret;
        if (!mops || !mops->write_init || !mops->write ||
@@ -300,11 +297,9 @@ int fpga_mgr_register(struct device *dev, const char *name,
        mgr->dev.id = id;
        dev_set_drvdata(dev, mgr);
-        dt_label = of_get_property(mgr->dev.of_node, "label", NULL);
+        ret = dev_set_name(&mgr->dev, "fpga%d", id);
-        if (dt_label)
+        if (ret)
-                ret = dev_set_name(&mgr->dev, "%s", dt_label);
+                goto error_device;
-        else
-                ret = dev_set_name(&mgr->dev, "fpga%d", id);
        ret = device_add(&mgr->dev);
        if (ret)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index f6ea4b43a60c..9c253c535d26 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -477,6 +477,14 @@ static void amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
                if (domain == AMDGPU_GEM_DOMAIN_CPU)
                        goto error_unreserve;
        }
+        list_for_each_entry(entry, &duplicates, head) {
+                domain = amdgpu_mem_type_to_domain(entry->bo->mem.mem_type);
+                /* if anything is swapped out don't swap it in here,
+                   just abort and wait for the next CS */
+                if (domain == AMDGPU_GEM_DOMAIN_CPU)
+                        goto error_unreserve;
+        }
        r = amdgpu_vm_update_page_directory(adev, bo_va->vm);
        if (r)
                goto error_unreserve;
diff --git a/drivers/gpu/drm/nouveau/include/nvkm/core/device.h b/drivers/gpu/drm/nouveau/include/nvkm/core/device.h
index 8f760002e401..913192c94876 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/core/device.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/core/device.h
@@ -159,7 +159,6 @@ struct nvkm_device_func {
 struct nvkm_device_quirk {
        u8 tv_pin_mask;
        u8 tv_gpio;
-        bool War00C800_0;
 };
 struct nvkm_device_chip {
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c
index caf22b589edc..62ad0300cfa5 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c
@@ -259,12 +259,6 @@ nvkm_device_pci_10de_0df4[] = {
 };
 static const struct nvkm_device_pci_vendor
-nvkm_device_pci_10de_0fcd[] = {
-        { 0x17aa, 0x3801, NULL, { .War00C800_0 = true } }, /* Lenovo Y510P */
-        {}
-};
-static const struct nvkm_device_pci_vendor
 nvkm_device_pci_10de_0fd2[] = {
        { 0x1028, 0x0595, "GeForce GT 640M LE" },
        { 0x1028, 0x05b2, "GeForce GT 640M LE" },
@@ -279,12 +273,6 @@ nvkm_device_pci_10de_0fe3[] = {
 };
 static const struct nvkm_device_pci_vendor
-nvkm_device_pci_10de_0fe4[] = {
-        { 0x144d, 0xc740, NULL, { .War00C800_0 = true } },
-        {}
-};
-static const struct nvkm_device_pci_vendor
 nvkm_device_pci_10de_104b[] = {
        { 0x1043, 0x844c, "GeForce GT 625" },
        { 0x1043, 0x846b, "GeForce GT 625" },
@@ -690,13 +678,6 @@ nvkm_device_pci_10de_1189[] = {
 static const struct nvkm_device_pci_vendor
 nvkm_device_pci_10de_1199[] = {
        { 0x1458, 0xd001, "GeForce GTX 760" },
-        { 0x1462, 0x1106, "GeForce GTX 780M", { .War00C800_0 = true } }, /* Medion Erazer X7827 */
-        {}
-};
-static const struct nvkm_device_pci_vendor
-nvkm_device_pci_10de_11e0[] = {
-        { 0x1558, 0x5106, NULL, { .War00C800_0 = true } },
        {}
 };
@@ -707,14 +688,6 @@ nvkm_device_pci_10de_11e3[] = {
 };
 static const struct nvkm_device_pci_vendor
-nvkm_device_pci_10de_11fc[] = {
-        { 0x1179, 0x0001, NULL, { .War00C800_0 = true } }, /* Toshiba Tecra W50 */
-        { 0x17aa, 0x2211, NULL, { .War00C800_0 = true } }, /* Lenovo W541 */
-        { 0x17aa, 0x221e, NULL, { .War00C800_0 = true } }, /* Lenovo W541 */
-        {}
-};
-static const struct nvkm_device_pci_vendor
 nvkm_device_pci_10de_1247[] = {
        { 0x1043, 0x212a, "GeForce GT 635M" },
        { 0x1043, 0x212b, "GeForce GT 635M" },
@@ -1368,7 +1341,7 @@ nvkm_device_pci_10de[] = {
        { 0x0fc6, "GeForce GTX 650" },
        { 0x0fc8, "GeForce GT 740" },
        { 0x0fc9, "GeForce GT 730" },
-        { 0x0fcd, "GeForce GT 755M", nvkm_device_pci_10de_0fcd },
+        { 0x0fcd, "GeForce GT 755M" },
        { 0x0fce, "GeForce GT 640M LE" },
        { 0x0fd1, "GeForce GT 650M" },
        { 0x0fd2, "GeForce GT 640M", nvkm_device_pci_10de_0fd2 },
@@ -1382,7 +1355,7 @@ nvkm_device_pci_10de[] = {
        { 0x0fe1, "GeForce GT 730M" },
        { 0x0fe2, "GeForce GT 745M" },
        { 0x0fe3, "GeForce GT 745M", nvkm_device_pci_10de_0fe3 },
-        { 0x0fe4, "GeForce GT 750M", nvkm_device_pci_10de_0fe4 },
+        { 0x0fe4, "GeForce GT 750M" },
        { 0x0fe9, "GeForce GT 750M" },
        { 0x0fea, "GeForce GT 755M" },
        { 0x0fec, "GeForce 710A" },
@@ -1497,12 +1470,12 @@ nvkm_device_pci_10de[] = {
        { 0x11c6, "GeForce GTX 650 Ti" },
        { 0x11c8, "GeForce GTX 650" },
        { 0x11cb, "GeForce GT 740" },
-        { 0x11e0, "GeForce GTX 770M", nvkm_device_pci_10de_11e0 },
+        { 0x11e0, "GeForce GTX 770M" },
        { 0x11e1, "GeForce GTX 765M" },
        { 0x11e2, "GeForce GTX 765M" },
        { 0x11e3, "GeForce GTX 760M", nvkm_device_pci_10de_11e3 },
        { 0x11fa, "Quadro K4000" },
-        { 0x11fc, "Quadro K2100M", nvkm_device_pci_10de_11fc },
+        { 0x11fc, "Quadro K2100M" },
        { 0x1200, "GeForce GTX 560 Ti" },
        { 0x1201, "GeForce GTX 560" },
        { 0x1203, "GeForce GTX 460 SE v2" },
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gk104.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gk104.c
index d942fa7b9f18..86f9f3b13f71 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gk104.c
@@ -81,9 +81,7 @@ gk104_pmu_pgob(struct nvkm_pmu *pmu, bool enable)
        nvkm_mask(device, 0x000200, 0x00001000, 0x00001000);
        nvkm_rd32(device, 0x000200);
-        if ( nvkm_boolopt(device->cfgopt, "War00C800_0",
+        if (nvkm_boolopt(device->cfgopt, "War00C800_0", true)) {
-            device->quirk ? device->quirk->War00C800_0 : false)) {
-                nvkm_info(&pmu->subdev, "hw bug workaround enabled\n");
                switch (device->chipset) {
                case 0xe4:
                        magic(device, 0x04000000);
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 0154db43860c..f81fb2641097 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -4173,11 +4173,7 @@ void cik_ring_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib)
        control |= ib->length_dw | (vm_id << 24);
        radeon_ring_write(ring, header);
-        radeon_ring_write(ring,
+        radeon_ring_write(ring, (ib->gpu_addr & 0xFFFFFFFC));
-#ifdef __BIG_ENDIAN
-                          (2 << 0) |
-#endif
-                          (ib->gpu_addr & 0xFFFFFFFC));
        radeon_ring_write(ring, upper_32_bits(ib->gpu_addr) & 0xFFFF);
        radeon_ring_write(ring, control);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_vce.c b/drivers/gpu/drm/radeon/radeon_vce.c
index 574f62bbd215..7eb1ae758906 100644
--- a/drivers/gpu/drm/radeon/radeon_vce.c
+++ b/drivers/gpu/drm/radeon/radeon_vce.c
@@ -361,31 +361,31 @@ int radeon_vce_get_create_msg(struct radeon_device *rdev, int ring,
        /* stitch together an VCE create msg */
        ib.length_dw = 0;
-        ib.ptr[ib.length_dw++] = 0x0000000c; /* len */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x0000000c); /* len */
-        ib.ptr[ib.length_dw++] = 0x00000001; /* session cmd */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000001); /* session cmd */
-        ib.ptr[ib.length_dw++] = handle;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(handle);
-        ib.ptr[ib.length_dw++] = 0x00000030; /* len */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000030); /* len */
-        ib.ptr[ib.length_dw++] = 0x01000001; /* create cmd */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x01000001); /* create cmd */
-        ib.ptr[ib.length_dw++] = 0x00000000;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000000);
-        ib.ptr[ib.length_dw++] = 0x00000042;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000042);
-        ib.ptr[ib.length_dw++] = 0x0000000a;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x0000000a);
-        ib.ptr[ib.length_dw++] = 0x00000001;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000001);
-        ib.ptr[ib.length_dw++] = 0x00000080;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000080);
-        ib.ptr[ib.length_dw++] = 0x00000060;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000060);
-        ib.ptr[ib.length_dw++] = 0x00000100;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000100);
-        ib.ptr[ib.length_dw++] = 0x00000100;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000100);
-        ib.ptr[ib.length_dw++] = 0x0000000c;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x0000000c);
-        ib.ptr[ib.length_dw++] = 0x00000000;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000000);
-        ib.ptr[ib.length_dw++] = 0x00000014; /* len */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000014); /* len */
-        ib.ptr[ib.length_dw++] = 0x05000005; /* feedback buffer */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x05000005); /* feedback buffer */
-        ib.ptr[ib.length_dw++] = upper_32_bits(dummy);
+        ib.ptr[ib.length_dw++] = cpu_to_le32(upper_32_bits(dummy));
-        ib.ptr[ib.length_dw++] = dummy;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(dummy);
-        ib.ptr[ib.length_dw++] = 0x00000001;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000001);
        for (i = ib.length_dw; i < ib_size_dw; ++i)
-                ib.ptr[i] = 0x0;
+                ib.ptr[i] = cpu_to_le32(0x0);
        r = radeon_ib_schedule(rdev, &ib, NULL, false);
        if (r) {
@@ -428,21 +428,21 @@ int radeon_vce_get_destroy_msg(struct radeon_device *rdev, int ring,
        /* stitch together an VCE destroy msg */
        ib.length_dw = 0;
-        ib.ptr[ib.length_dw++] = 0x0000000c; /* len */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x0000000c); /* len */
-        ib.ptr[ib.length_dw++] = 0x00000001; /* session cmd */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000001); /* session cmd */
-        ib.ptr[ib.length_dw++] = handle;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(handle);
-        ib.ptr[ib.length_dw++] = 0x00000014; /* len */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000014); /* len */
-        ib.ptr[ib.length_dw++] = 0x05000005; /* feedback buffer */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x05000005); /* feedback buffer */
-        ib.ptr[ib.length_dw++] = upper_32_bits(dummy);
+        ib.ptr[ib.length_dw++] = cpu_to_le32(upper_32_bits(dummy));
-        ib.ptr[ib.length_dw++] = dummy;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(dummy);
-        ib.ptr[ib.length_dw++] = 0x00000001;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000001);
-        ib.ptr[ib.length_dw++] = 0x00000008; /* len */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000008); /* len */
-        ib.ptr[ib.length_dw++] = 0x02000001; /* destroy cmd */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x02000001); /* destroy cmd */
        for (i = ib.length_dw; i < ib_size_dw; ++i)
-                ib.ptr[i] = 0x0;
+                ib.ptr[i] = cpu_to_le32(0x0);
        r = radeon_ib_schedule(rdev, &ib, NULL, false);
        if (r) {
@@ -699,12 +699,12 @@ bool radeon_vce_semaphore_emit(struct radeon_device *rdev,
 {
        uint64_t addr = semaphore->gpu_addr;
-        radeon_ring_write(ring, VCE_CMD_SEMAPHORE);
+        radeon_ring_write(ring, cpu_to_le32(VCE_CMD_SEMAPHORE));
-        radeon_ring_write(ring, (addr >> 3) & 0x000FFFFF);
+        radeon_ring_write(ring, cpu_to_le32((addr >> 3) & 0x000FFFFF));
-        radeon_ring_write(ring, (addr >> 23) & 0x000FFFFF);
+        radeon_ring_write(ring, cpu_to_le32((addr >> 23) & 0x000FFFFF));
-        radeon_ring_write(ring, 0x01003000 | (emit_wait ? 1 : 0));
+        radeon_ring_write(ring, cpu_to_le32(0x01003000 | (emit_wait ? 1 : 0)));
        if (!emit_wait)
-                radeon_ring_write(ring, VCE_CMD_END);
+                radeon_ring_write(ring, cpu_to_le32(VCE_CMD_END));
        return true;
 }
@@ -719,10 +719,10 @@ bool radeon_vce_semaphore_emit(struct radeon_device *rdev,
 void radeon_vce_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib)
 {
        struct radeon_ring *ring = &rdev->ring[ib->ring];
-        radeon_ring_write(ring, VCE_CMD_IB);
+        radeon_ring_write(ring, cpu_to_le32(VCE_CMD_IB));
-        radeon_ring_write(ring, ib->gpu_addr);
+        radeon_ring_write(ring, cpu_to_le32(ib->gpu_addr));
-        radeon_ring_write(ring, upper_32_bits(ib->gpu_addr));
+        radeon_ring_write(ring, cpu_to_le32(upper_32_bits(ib->gpu_addr)));
-        radeon_ring_write(ring, ib->length_dw);
+        radeon_ring_write(ring, cpu_to_le32(ib->length_dw));
 }
 /**
@@ -738,12 +738,12 @@ void radeon_vce_fence_emit(struct radeon_device *rdev,
        struct radeon_ring *ring = &rdev->ring[fence->ring];
        uint64_t addr = rdev->fence_drv[fence->ring].gpu_addr;
-        radeon_ring_write(ring, VCE_CMD_FENCE);
+        radeon_ring_write(ring, cpu_to_le32(VCE_CMD_FENCE));
-        radeon_ring_write(ring, addr);
+        radeon_ring_write(ring, cpu_to_le32(addr));
-        radeon_ring_write(ring, upper_32_bits(addr));
+        radeon_ring_write(ring, cpu_to_le32(upper_32_bits(addr)));
-        radeon_ring_write(ring, fence->seq);
+        radeon_ring_write(ring, cpu_to_le32(fence->seq));
-        radeon_ring_write(ring, VCE_CMD_TRAP);
+        radeon_ring_write(ring, cpu_to_le32(VCE_CMD_TRAP));
-        radeon_ring_write(ring, VCE_CMD_END);
+        radeon_ring_write(ring, cpu_to_le32(VCE_CMD_END));
 }
 /**
@@ -765,7 +765,7 @@ int radeon_vce_ring_test(struct radeon_device *rdev, struct radeon_ring *ring)
                          ring->idx, r);
                return r;
        }
-        radeon_ring_write(ring, VCE_CMD_END);
+        radeon_ring_write(ring, cpu_to_le32(VCE_CMD_END));
        radeon_ring_unlock_commit(rdev, ring, false);
        for (i = 0; i < rdev->usec_timeout; i++) {
diff --git a/drivers/gpu/drm/ttm/ttm_lock.c b/drivers/gpu/drm/ttm/ttm_lock.c
index 6a954544727f..f154fb1929bd 100644
--- a/drivers/gpu/drm/ttm/ttm_lock.c
+++ b/drivers/gpu/drm/ttm/ttm_lock.c
@@ -180,7 +180,7 @@ int ttm_write_lock(struct ttm_lock *lock, bool interruptible)
                        spin_unlock(&lock->lock);
                }
        } else
-                wait_event(lock->queue, __ttm_read_lock(lock));
+                wait_event(lock->queue, __ttm_write_lock(lock));
        return ret;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index a09cf8529b9f..c49812b80dd0 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -1233,6 +1233,7 @@ static void vmw_master_drop(struct drm_device *dev,
        vmw_fp->locked_master = drm_master_get(file_priv->master);
        ret = ttm_vt_lock(&vmaster->lock, false, vmw_fp->tfile);
+        vmw_kms_legacy_hotspot_clear(dev_priv);
        if (unlikely((ret != 0))) {
                DRM_ERROR("Unable to lock TTM at VT switch.\n");
                drm_master_put(&vmw_fp->locked_master);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index a8ae9dfb83b7..469cdd520615 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -925,6 +925,7 @@ int vmw_kms_present(struct vmw_private *dev_priv,
                    uint32_t num_clips);
 int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                                struct drm_file *file_priv);
+void vmw_kms_legacy_hotspot_clear(struct vmw_private *dev_priv);
 int vmw_dumb_create(struct drm_file *file_priv,
                    struct drm_device *dev,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index a8baf5f5e765..b6a0806b06bf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -390,7 +390,7 @@ void *vmw_fifo_reserve_dx(struct vmw_private *dev_priv, uint32_t bytes,
        else if (ctx_id == SVGA3D_INVALID_ID)
                ret = vmw_local_fifo_reserve(dev_priv, bytes);
        else {
-                WARN_ON("Command buffer has not been allocated.\n");
+                WARN(1, "Command buffer has not been allocated.\n");
                ret = NULL;
        }
        if (IS_ERR_OR_NULL(ret)) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 9fcd7f82995c..9b4bb9e74d73 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -133,13 +133,19 @@ void vmw_cursor_update_position(struct vmw_private *dev_priv,
        vmw_mmio_write(++count, fifo_mem + SVGA_FIFO_CURSOR_COUNT);
 }
-int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
-                           uint32_t handle, uint32_t width, uint32_t height)
+/*
+ * vmw_du_crtc_cursor_set2 - Driver cursor_set2 callback.
+ */
+int vmw_du_crtc_cursor_set2(struct drm_crtc *crtc, struct drm_file *file_priv,
+                            uint32_t handle, uint32_t width, uint32_t height,
+                            int32_t hot_x, int32_t hot_y)
 {
        struct vmw_private *dev_priv = vmw_priv(crtc->dev);
        struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
        struct vmw_surface *surface = NULL;
        struct vmw_dma_buffer *dmabuf = NULL;
+        s32 hotspot_x, hotspot_y;
        int ret;
        /*
@@ -151,6 +157,8 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
         */
        drm_modeset_unlock_crtc(crtc);
        drm_modeset_lock_all(dev_priv->dev);
+        hotspot_x = hot_x + du->hotspot_x;
+        hotspot_y = hot_y + du->hotspot_y;
        /* A lot of the code assumes this */
        if (handle && (width != 64 || height != 64)) {
@@ -187,31 +195,34 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
                vmw_dmabuf_unreference(&du->cursor_dmabuf);
        /* setup new image */
+        ret = 0;
        if (surface) {
                /* vmw_user_surface_lookup takes one reference */
                du->cursor_surface = surface;
                du->cursor_surface->snooper.crtc = crtc;
                du->cursor_age = du->cursor_surface->snooper.age;
-                vmw_cursor_update_image(dev_priv, surface->snooper.image,
+                ret = vmw_cursor_update_image(dev_priv, surface->snooper.image,
-                                        64, 64, du->hotspot_x, du->hotspot_y);
+                                              64, 64, hotspot_x, hotspot_y);
        } else if (dmabuf) {
                /* vmw_user_surface_lookup takes one reference */
                du->cursor_dmabuf = dmabuf;
                ret = vmw_cursor_update_dmabuf(dev_priv, dmabuf, width, height,
-                                               du->hotspot_x, du->hotspot_y);
+                                               hotspot_x, hotspot_y);
        } else {
                vmw_cursor_update_position(dev_priv, false, 0, 0);
-                ret = 0;
                goto out;
        }
-        vmw_cursor_update_position(dev_priv, true,
+        if (!ret) {
-                                   du->cursor_x + du->hotspot_x,
+                vmw_cursor_update_position(dev_priv, true,
-                                   du->cursor_y + du->hotspot_y);
+                                           du->cursor_x + hotspot_x,
+                                           du->cursor_y + hotspot_y);
+                du->core_hotspot_x = hot_x;
+                du->core_hotspot_y = hot_y;
+        }
-        ret = 0;
 out:
        drm_modeset_unlock_all(dev_priv->dev);
        drm_modeset_lock_crtc(crtc, crtc->cursor);
@@ -239,8 +250,10 @@ int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
        drm_modeset_lock_all(dev_priv->dev);
        vmw_cursor_update_position(dev_priv, shown,
-                                   du->cursor_x + du->hotspot_x,
+                                   du->cursor_x + du->hotspot_x +
-                                   du->cursor_y + du->hotspot_y);
+                                   du->core_hotspot_x,
+                                   du->cursor_y + du->hotspot_y +
+                                   du->core_hotspot_y);
        drm_modeset_unlock_all(dev_priv->dev);
        drm_modeset_lock_crtc(crtc, crtc->cursor);
@@ -334,6 +347,29 @@ err_unreserve:
        ttm_bo_unreserve(bo);
 }
+/**
+ * vmw_kms_legacy_hotspot_clear - Clear legacy hotspots
+ *
+ * @dev_priv: Pointer to the device private struct.
+ *
+ * Clears all legacy hotspots.
+ */
+void vmw_kms_legacy_hotspot_clear(struct vmw_private *dev_priv)
+{
+        struct drm_device *dev = dev_priv->dev;
+        struct vmw_display_unit *du;
+        struct drm_crtc *crtc;
+        drm_modeset_lock_all(dev);
+        drm_for_each_crtc(crtc, dev) {
+                du = vmw_crtc_to_du(crtc);
+                du->hotspot_x = 0;
+                du->hotspot_y = 0;
+        }
+        drm_modeset_unlock_all(dev);
+}
 void vmw_kms_cursor_post_execbuf(struct vmw_private *dev_priv)
 {
        struct drm_device *dev = dev_priv->dev;
@@ -351,7 +387,9 @@ void vmw_kms_cursor_post_execbuf(struct vmw_private *dev_priv)
                du->cursor_age = du->cursor_surface->snooper.age;
                vmw_cursor_update_image(dev_priv,
                                        du->cursor_surface->snooper.image,
-                                        64, 64, du->hotspot_x, du->hotspot_y);
+                                        64, 64,
+                                        du->hotspot_x + du->core_hotspot_x,
+                                        du->hotspot_y + du->core_hotspot_y);
        }
        mutex_unlock(&dev->mode_config.mutex);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
index 782df7ca9794..edd81503516d 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
@@ -159,6 +159,8 @@ struct vmw_display_unit {
        int hotspot_x;
        int hotspot_y;
+        s32 core_hotspot_x;
+        s32 core_hotspot_y;
        unsigned unit;
@@ -193,8 +195,9 @@ void vmw_du_crtc_restore(struct drm_crtc *crtc);
 void vmw_du_crtc_gamma_set(struct drm_crtc *crtc,
                           u16 *r, u16 *g, u16 *b,
                           uint32_t start, uint32_t size);
-int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
+int vmw_du_crtc_cursor_set2(struct drm_crtc *crtc, struct drm_file *file_priv,
-                           uint32_t handle, uint32_t width, uint32_t height);
+                            uint32_t handle, uint32_t width, uint32_t height,
+                            int32_t hot_x, int32_t hot_y);
 int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y);
 int vmw_du_connector_dpms(struct drm_connector *connector, int mode);
 void vmw_du_connector_save(struct drm_connector *connector);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index bb63e4d795fa..52caecb4502e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -297,7 +297,7 @@ static int vmw_ldu_crtc_set_config(struct drm_mode_set *set)
 static struct drm_crtc_funcs vmw_legacy_crtc_funcs = {
        .save = vmw_du_crtc_save,
        .restore = vmw_du_crtc_restore,
-        .cursor_set = vmw_du_crtc_cursor_set,
+        .cursor_set2 = vmw_du_crtc_cursor_set2,
        .cursor_move = vmw_du_crtc_cursor_move,
        .gamma_set = vmw_du_crtc_gamma_set,
        .destroy = vmw_ldu_crtc_destroy,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
index b96d1ab610c5..13926ff192e3 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
@@ -533,7 +533,7 @@ out_no_fence:
 static struct drm_crtc_funcs vmw_screen_object_crtc_funcs = {
        .save = vmw_du_crtc_save,
        .restore = vmw_du_crtc_restore,
-        .cursor_set = vmw_du_crtc_cursor_set,
+        .cursor_set2 = vmw_du_crtc_cursor_set2,
        .cursor_move = vmw_du_crtc_cursor_move,
        .gamma_set = vmw_du_crtc_gamma_set,
        .destroy = vmw_sou_crtc_destroy,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index b1fc1c02792d..f823fc3efed7 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -1043,7 +1043,7 @@ out_finish:
 static struct drm_crtc_funcs vmw_stdu_crtc_funcs = {
        .save = vmw_du_crtc_save,
        .restore = vmw_du_crtc_restore,
-        .cursor_set = vmw_du_crtc_cursor_set,
+        .cursor_set2 = vmw_du_crtc_cursor_set2,
        .cursor_move = vmw_du_crtc_cursor_move,
        .gamma_set = vmw_du_crtc_gamma_set,
        .destroy = vmw_stdu_crtc_destroy,
diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
index 3166e4bc4eb6..9abcaa53bd25 100644
--- a/drivers/gpu/vga/vgaarb.c
+++ b/drivers/gpu/vga/vgaarb.c
@@ -395,8 +395,10 @@ int vga_get(struct pci_dev *pdev, unsigned int rsrc, int interruptible)
                set_current_state(interruptible ?
                                  TASK_INTERRUPTIBLE :
                                  TASK_UNINTERRUPTIBLE);
-                if (signal_pending(current)) {
+                if (interruptible && signal_pending(current)) {
-                        rc = -EINTR;
+                        __set_current_state(TASK_RUNNING);
+                        remove_wait_queue(&vga_wait_queue, &wait);
+                        rc = -ERESTARTSYS;
                        break;
                }
                schedule();
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 9024a3de4032..8b78a7f1f779 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -316,11 +316,6 @@
 #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001       0xa001
 #define USB_VENDOR_ID_ELAN              0x04f3
-#define USB_DEVICE_ID_ELAN_TOUCHSCREEN  0x0089
-#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B     0x009b
-#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103     0x0103
-#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_010c     0x010c
-#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F     0x016f
 #define USB_VENDOR_ID_ELECOM            0x056e
 #define USB_DEVICE_ID_ELECOM_BM084      0x0061
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 2324520b006d..7dd0953cd70f 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -72,11 +72,7 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
        { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
-        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_ELAN, HID_ANY_ID, HID_QUIRK_ALWAYS_POLL },
-        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL },
-        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103, HID_QUIRK_ALWAYS_POLL },
-        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_010c, HID_QUIRK_ALWAYS_POLL },
-        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F, HID_QUIRK_ALWAYS_POLL },
        { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
@@ -340,7 +336,8 @@ static const struct hid_blacklist *usbhid_exists_squirk(const u16 idVendor,
        for (; hid_blacklist[n].idVendor; n++)
                if (hid_blacklist[n].idVendor == idVendor &&
-                                hid_blacklist[n].idProduct == idProduct)
+                        (hid_blacklist[n].idProduct == (__u16) HID_ANY_ID ||
+                                hid_blacklist[n].idProduct == idProduct))
                        bl_entry = &hid_blacklist[n];
        if (bl_entry != NULL)
diff --git a/drivers/iio/adc/qcom-spmi-vadc.c b/drivers/iio/adc/qcom-spmi-vadc.c
index 0c4618b4d515..c2babe50a0d8 100644
--- a/drivers/iio/adc/qcom-spmi-vadc.c
+++ b/drivers/iio/adc/qcom-spmi-vadc.c
@@ -839,8 +839,10 @@ static int vadc_get_dt_data(struct vadc_priv *vadc, struct device_node *node)
        for_each_available_child_of_node(node, child) {
                ret = vadc_get_dt_channel_data(vadc->dev, &prop, child);
-                if (ret)
+                if (ret) {
+                        of_node_put(child);
                        return ret;
+                }
                vadc->chan_props[index] = prop;
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index d7e908acb480..0f6f63b20263 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -302,7 +302,7 @@ static int iio_scan_mask_set(struct iio_dev *indio_dev,
        if (trialmask == NULL)
                return -ENOMEM;
        if (!indio_dev->masklength) {
-                WARN_ON("Trying to set scanmask prior to registering buffer\n");
+                WARN(1, "Trying to set scanmask prior to registering buffer\n");
                goto err_invalid_mask;
        }
        bitmap_copy(trialmask, buffer->scan_mask, indio_dev->masklength);
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 208358f9e7e3..159ede61f793 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -655,7 +655,7 @@ int __iio_device_attr_init(struct device_attribute *dev_attr,
                        break;
                case IIO_SEPARATE:
                        if (!chan->indexed) {
-                                WARN_ON("Differential channels must be indexed\n");
+                                WARN(1, "Differential channels must be indexed\n");
                                ret = -EINVAL;
                                goto error_free_full_postfix;
                        }
diff --git a/drivers/iio/light/apds9960.c b/drivers/iio/light/apds9960.c
index 7d269ef9e062..f6a07dc32ae4 100644
--- a/drivers/iio/light/apds9960.c
+++ b/drivers/iio/light/apds9960.c
@@ -453,6 +453,7 @@ static int apds9960_set_power_state(struct apds9960_data *data, bool on)
                        usleep_range(data->als_adc_int_us,
                                     APDS9960_MAX_INT_TIME_IN_US);
        } else {
+                pm_runtime_mark_last_busy(dev);
                ret = pm_runtime_put_autosuspend(dev);
        }
diff --git a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
index 961f9f990faf..e544fcfd5ced 100644
--- a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
+++ b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
@@ -130,10 +130,10 @@ static int lidar_get_measurement(struct lidar_data *data, u16 *reg)
                if (ret < 0)
                        break;
-                /* return 0 since laser is likely pointed out of range */
+                /* return -EINVAL since laser is likely pointed out of range */
                if (ret & LIDAR_REG_STATUS_INVALID) {
                        *reg = 0;
-                        ret = 0;
+                        ret = -EINVAL;
                        break;
                }
@@ -197,7 +197,7 @@ static irqreturn_t lidar_trigger_handler(int irq, void *private)
        if (!ret) {
                iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
                                                   iio_get_time_ns());
-        } else {
+        } else if (ret != -EINVAL) {
                dev_err(&data->client->dev, "cannot read LIDAR measurement");
        }
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 944cd90417bc..d2d5d004f16d 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1126,10 +1126,7 @@ static bool validate_ipv4_net_dev(struct net_device *net_dev,
        rcu_read_lock();
        err = fib_lookup(dev_net(net_dev), &fl4, &res, 0);
-        if (err)
+        ret = err == 0 && FIB_RES_DEV(res) == net_dev;
-                return false;
-        ret = FIB_RES_DEV(res) == net_dev;
        rcu_read_unlock();
        return ret;
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 8d8af7a41a30..2281de122038 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -1811,6 +1811,11 @@ static int validate_mad(const struct ib_mad_hdr *mad_hdr,
                if (qp_num == 0)
                        valid = 1;
        } else {
+                /* CM attributes other than ClassPortInfo only use Send method */
+                if ((mad_hdr->mgmt_class == IB_MGMT_CLASS_CM) &&
+                    (mad_hdr->attr_id != IB_MGMT_CLASSPORTINFO_ATTR_ID) &&
+                    (mad_hdr->method != IB_MGMT_METHOD_SEND))
+                        goto out;
                /* Filter GSI packets sent to QP0 */
                if (qp_num != 0)
                        valid = 1;
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 2aba774f835b..a95a32ba596e 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -512,7 +512,7 @@ static int ib_nl_get_path_rec_attrs_len(ib_sa_comp_mask comp_mask)
        return len;
 }
-static int ib_nl_send_msg(struct ib_sa_query *query)
+static int ib_nl_send_msg(struct ib_sa_query *query, gfp_t gfp_mask)
 {
        struct sk_buff *skb = NULL;
        struct nlmsghdr *nlh;
@@ -526,7 +526,7 @@ static int ib_nl_send_msg(struct ib_sa_query *query)
        if (len <= 0)
                return -EMSGSIZE;
-        skb = nlmsg_new(len, GFP_KERNEL);
+        skb = nlmsg_new(len, gfp_mask);
        if (!skb)
                return -ENOMEM;
@@ -544,7 +544,7 @@ static int ib_nl_send_msg(struct ib_sa_query *query)
        /* Repair the nlmsg header length */
        nlmsg_end(skb, nlh);
-        ret = ibnl_multicast(skb, nlh, RDMA_NL_GROUP_LS, GFP_KERNEL);
+        ret = ibnl_multicast(skb, nlh, RDMA_NL_GROUP_LS, gfp_mask);
        if (!ret)
                ret = len;
        else
@@ -553,7 +553,7 @@ static int ib_nl_send_msg(struct ib_sa_query *query)
        return ret;
 }
-static int ib_nl_make_request(struct ib_sa_query *query)
+static int ib_nl_make_request(struct ib_sa_query *query, gfp_t gfp_mask)
 {
        unsigned long flags;
        unsigned long delay;
@@ -562,25 +562,27 @@ static int ib_nl_make_request(struct ib_sa_query *query)
        INIT_LIST_HEAD(&query->list);
        query->seq = (u32)atomic_inc_return(&ib_nl_sa_request_seq);
+        /* Put the request on the list first.*/
        spin_lock_irqsave(&ib_nl_request_lock, flags);
-        ret = ib_nl_send_msg(query);
-        if (ret <= 0) {
-                ret = -EIO;
-                goto request_out;
-        } else {
-                ret = 0;
-        }
        delay = msecs_to_jiffies(sa_local_svc_timeout_ms);
        query->timeout = delay + jiffies;
        list_add_tail(&query->list, &ib_nl_request_list);
        /* Start the timeout if this is the only request */
        if (ib_nl_request_list.next == &query->list)
                queue_delayed_work(ib_nl_wq, &ib_nl_timed_work, delay);
-request_out:
        spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+        ret = ib_nl_send_msg(query, gfp_mask);
+        if (ret <= 0) {
+                ret = -EIO;
+                /* Remove the request */
+                spin_lock_irqsave(&ib_nl_request_lock, flags);
+                list_del(&query->list);
+                spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+        } else {
+                ret = 0;
+        }
        return ret;
 }
@@ -1108,7 +1110,7 @@ static int send_mad(struct ib_sa_query *query, int timeout_ms, gfp_t gfp_mask)
        if (query->flags & IB_SA_ENABLE_LOCAL_SERVICE) {
                if (!ibnl_chk_listeners(RDMA_NL_GROUP_LS)) {
-                        if (!ib_nl_make_request(query))
+                        if (!ib_nl_make_request(query, gfp_mask))
                                return id;
                }
                ib_sa_disable_local_svc(query);
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 94816aeb95a0..1c02deab068f 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -62,9 +62,11 @@ static struct uverbs_lock_class rule_lock_class = { .name = "RULE-uobj" };
 * The ib_uobject locking scheme is as follows:
 *
 * - ib_uverbs_idr_lock protects the uverbs idrs themselves, so it
- *   needs to be held during all idr operations.  When an object is
+ *   needs to be held during all idr write operations.  When an object is
 *   looked up, a reference must be taken on the object's kref before
- *   dropping this lock.
+ *   dropping this lock.  For read operations, the rcu_read_lock()
+ *   and rcu_write_lock() but similarly the kref reference is grabbed
+ *   before the rcu_read_unlock().
 *
 * - Each object also has an rwsem.  This rwsem must be held for
 *   reading while an operation that uses the object is performed.
@@ -96,7 +98,7 @@ static void init_uobj(struct ib_uobject *uobj, u64 user_handle,
 static void release_uobj(struct kref *kref)
 {
-        kfree(container_of(kref, struct ib_uobject, ref));
+        kfree_rcu(container_of(kref, struct ib_uobject, ref), rcu);
 }
 static void put_uobj(struct ib_uobject *uobj)
@@ -145,7 +147,7 @@ static struct ib_uobject *__idr_get_uobj(struct idr *idr, int id,
 {
        struct ib_uobject *uobj;
-        spin_lock(&ib_uverbs_idr_lock);
+        rcu_read_lock();
        uobj = idr_find(idr, id);
        if (uobj) {
                if (uobj->context == context)
@@ -153,7 +155,7 @@ static struct ib_uobject *__idr_get_uobj(struct idr *idr, int id,
                else
                        uobj = NULL;
        }
-        spin_unlock(&ib_uverbs_idr_lock);
+        rcu_read_unlock();
        return uobj;
 }
@@ -2446,6 +2448,7 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
        int                             i, sg_ind;
        int                             is_ud;
        ssize_t                         ret = -EINVAL;
+        size_t                          next_size;
        if (copy_from_user(&cmd, buf, sizeof cmd))
                return -EFAULT;
@@ -2490,7 +2493,8 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
                                goto out_put;
                        }
-                        ud = alloc_wr(sizeof(*ud), user_wr->num_sge);
+                        next_size = sizeof(*ud);
+                        ud = alloc_wr(next_size, user_wr->num_sge);
                        if (!ud) {
                                ret = -ENOMEM;
                                goto out_put;
@@ -2511,7 +2515,8 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
                           user_wr->opcode == IB_WR_RDMA_READ) {
                        struct ib_rdma_wr *rdma;
-                        rdma = alloc_wr(sizeof(*rdma), user_wr->num_sge);
+                        next_size = sizeof(*rdma);
+                        rdma = alloc_wr(next_size, user_wr->num_sge);
                        if (!rdma) {
                                ret = -ENOMEM;
                                goto out_put;
@@ -2525,7 +2530,8 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
                           user_wr->opcode == IB_WR_ATOMIC_FETCH_AND_ADD) {
                        struct ib_atomic_wr *atomic;
-                        atomic = alloc_wr(sizeof(*atomic), user_wr->num_sge);
+                        next_size = sizeof(*atomic);
+                        atomic = alloc_wr(next_size, user_wr->num_sge);
                        if (!atomic) {
                                ret = -ENOMEM;
                                goto out_put;
@@ -2540,7 +2546,8 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
                } else if (user_wr->opcode == IB_WR_SEND ||
                           user_wr->opcode == IB_WR_SEND_WITH_IMM ||
                           user_wr->opcode == IB_WR_SEND_WITH_INV) {
-                        next = alloc_wr(sizeof(*next), user_wr->num_sge);
+                        next_size = sizeof(*next);
+                        next = alloc_wr(next_size, user_wr->num_sge);
                        if (!next) {
                                ret = -ENOMEM;
                                goto out_put;
@@ -2572,7 +2579,7 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
                if (next->num_sge) {
                        next->sg_list = (void *) next +
-                                ALIGN(sizeof *next, sizeof (struct ib_sge));
+                                ALIGN(next_size, sizeof(struct ib_sge));
                        if (copy_from_user(next->sg_list,
                                           buf + sizeof cmd +
                                           cmd.wr_count * cmd.wqe_size +
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 043a60ee6836..545906dec26d 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1516,7 +1516,7 @@ EXPORT_SYMBOL(ib_map_mr_sg);
 * @sg_nents:      number of entries in sg
 * @set_page:      driver page assignment function pointer
 *
- * Core service helper for drivers to covert the largest
+ * Core service helper for drivers to convert the largest
 * prefix of given sg list to a page vector. The sg list
 * prefix converted is the prefix that meet the requirements
 * of ib_map_mr_sg.
@@ -1533,7 +1533,7 @@ int ib_sg_to_pages(struct ib_mr *mr,
        u64 last_end_dma_addr = 0, last_page_addr = 0;
        unsigned int last_page_off = 0;
        u64 page_mask = ~((u64)mr->page_size - 1);
-        int i;
+        int i, ret;
        mr->iova = sg_dma_address(&sgl[0]);
        mr->length = 0;
@@ -1544,27 +1544,29 @@ int ib_sg_to_pages(struct ib_mr *mr,
                u64 end_dma_addr = dma_addr + dma_len;
                u64 page_addr = dma_addr & page_mask;
-                if (i && page_addr != dma_addr) {
+                /*
-                        if (last_end_dma_addr != dma_addr) {
+                 * For the second and later elements, check whether either the
-                                /* gap */
+                 * end of element i-1 or the start of element i is not aligned
-                                goto done;
+                 * on a page boundary.
+                 */
-                        } else if (last_page_off + dma_len <= mr->page_size) {
+                if (i && (last_page_off != 0 || page_addr != dma_addr)) {
-                                /* chunk this fragment with the last */
+                        /* Stop mapping if there is a gap. */
-                                mr->length += dma_len;
+                        if (last_end_dma_addr != dma_addr)
-                                last_end_dma_addr += dma_len;
+                                break;
-                                last_page_off += dma_len;
-                                continue;
+                        /*
-                        } else {
+                         * Coalesce this element with the last. If it is small
-                                /* map starting from the next page */
+                         * enough just update mr->length. Otherwise start
-                                page_addr = last_page_addr + mr->page_size;
+                         * mapping from the next page.
-                                dma_len -= mr->page_size - last_page_off;
+                         */
-                        }
+                        goto next_page;
                }
                do {
-                        if (unlikely(set_page(mr, page_addr)))
+                        ret = set_page(mr, page_addr);
-                                goto done;
+                        if (unlikely(ret < 0))
+                                return i ? : ret;
+next_page:
                        page_addr += mr->page_size;
                } while (page_addr < end_dma_addr);
@@ -1574,7 +1576,6 @@ int ib_sg_to_pages(struct ib_mr *mr,
                last_page_off = end_dma_addr & ~page_mask;
        }
-done:
        return i;
 }
 EXPORT_SYMBOL(ib_sg_to_pages);
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index f567160a4a56..97d6878f9938 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -456,7 +456,7 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
        props->max_qp_wr           = dev->dev->caps.max_wqes - MLX4_IB_SQ_MAX_SPARE;
        props->max_sge             = min(dev->dev->caps.max_sq_sg,
                                         dev->dev->caps.max_rq_sg);
-        props->max_sge_rd = props->max_sge;
+        props->max_sge_rd          = MLX4_MAX_SGE_RD;
        props->max_cq              = dev->dev->quotas.cq;
        props->max_cqe             = dev->dev->caps.max_cqes;
        props->max_mr              = dev->dev->quotas.mpt;
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index a2e4ca56da44..13eaaf45288f 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -34,6 +34,7 @@
 #include <linux/log2.h>
 #include <linux/slab.h>
 #include <linux/netdevice.h>
+#include <linux/vmalloc.h>
 #include <rdma/ib_cache.h>
 #include <rdma/ib_pack.h>
@@ -795,8 +796,14 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                if (err)
                        goto err_mtt;
-                qp->sq.wrid  = kmalloc(qp->sq.wqe_cnt * sizeof (u64), gfp);
+                qp->sq.wrid = kmalloc(qp->sq.wqe_cnt * sizeof(u64), gfp);
-                qp->rq.wrid  = kmalloc(qp->rq.wqe_cnt * sizeof (u64), gfp);
+                if (!qp->sq.wrid)
+                        qp->sq.wrid = __vmalloc(qp->sq.wqe_cnt * sizeof(u64),
+                                                gfp, PAGE_KERNEL);
+                qp->rq.wrid = kmalloc(qp->rq.wqe_cnt * sizeof(u64), gfp);
+                if (!qp->rq.wrid)
+                        qp->rq.wrid = __vmalloc(qp->rq.wqe_cnt * sizeof(u64),
+                                                gfp, PAGE_KERNEL);
                if (!qp->sq.wrid || !qp->rq.wrid) {
                        err = -ENOMEM;
                        goto err_wrid;
@@ -886,8 +893,8 @@ err_wrid:
                if (qp_has_rq(init_attr))
                        mlx4_ib_db_unmap_user(to_mucontext(pd->uobject->context), &qp->db);
        } else {
-                kfree(qp->sq.wrid);
+                kvfree(qp->sq.wrid);
-                kfree(qp->rq.wrid);
+                kvfree(qp->rq.wrid);
        }
 err_mtt:
@@ -1062,8 +1069,8 @@ static void destroy_qp_common(struct mlx4_ib_dev *dev, struct mlx4_ib_qp *qp,
                                              &qp->db);
                ib_umem_release(qp->umem);
        } else {
-                kfree(qp->sq.wrid);
+                kvfree(qp->sq.wrid);
-                kfree(qp->rq.wrid);
+                kvfree(qp->rq.wrid);
                if (qp->mlx4_ib_qp_type & (MLX4_IB_QPT_PROXY_SMI_OWNER |
                    MLX4_IB_QPT_PROXY_SMI | MLX4_IB_QPT_PROXY_GSI))
                        free_proxy_bufs(&dev->ib_dev, qp);
diff --git a/drivers/infiniband/hw/mlx4/srq.c b/drivers/infiniband/hw/mlx4/srq.c
index dce5dfe3a70e..8d133c40fa0e 100644
--- a/drivers/infiniband/hw/mlx4/srq.c
+++ b/drivers/infiniband/hw/mlx4/srq.c
@@ -34,6 +34,7 @@
 #include <linux/mlx4/qp.h>
 #include <linux/mlx4/srq.h>
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
 #include "mlx4_ib.h"
 #include "user.h"
@@ -172,8 +173,12 @@ struct ib_srq *mlx4_ib_create_srq(struct ib_pd *pd,
                srq->wrid = kmalloc(srq->msrq.max * sizeof (u64), GFP_KERNEL);
                if (!srq->wrid) {
-                        err = -ENOMEM;
+                        srq->wrid = __vmalloc(srq->msrq.max * sizeof(u64),
-                        goto err_mtt;
+                                              GFP_KERNEL, PAGE_KERNEL);
+                        if (!srq->wrid) {
+                                err = -ENOMEM;
+                                goto err_mtt;
+                        }
                }
        }
@@ -204,7 +209,7 @@ err_wrid:
        if (pd->uobject)
                mlx4_ib_db_unmap_user(to_mucontext(pd->uobject->context), &srq->db);
        else
-                kfree(srq->wrid);
+                kvfree(srq->wrid);
 err_mtt:
        mlx4_mtt_cleanup(dev->dev, &srq->mtt);
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index ec8993a7b3be..6000f7aeede9 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -381,7 +381,19 @@ static void __cache_work_func(struct mlx5_cache_ent *ent)
                        }
                }
        } else if (ent->cur > 2 * ent->limit) {
-                if (!someone_adding(cache) &&
+                /*
+                 * The remove_keys() logic is performed as garbage collection
+                 * task. Such task is intended to be run when no other active
+                 * processes are running.
+                 *
+                 * The need_resched() will return TRUE if there are user tasks
+                 * to be activated in near future.
+                 *
+                 * In such case, we don't execute remove_keys() and postpone
+                 * the garbage collection work to try to run in next cycle,
+                 * in order to free CPU resources to other tasks.
+                 */
+                if (!need_resched() && !someone_adding(cache) &&
                    time_after(jiffies, cache->last_add + 300 * HZ)) {
                        remove_keys(dev, i, 1);
                        if (ent->cur > ent->limit)
diff --git a/drivers/infiniband/hw/qib/qib_qsfp.c b/drivers/infiniband/hw/qib/qib_qsfp.c
index 5e27f76805e2..4c7c3c84a741 100644
--- a/drivers/infiniband/hw/qib/qib_qsfp.c
+++ b/drivers/infiniband/hw/qib/qib_qsfp.c
@@ -292,7 +292,7 @@ int qib_refresh_qsfp_cache(struct qib_pportdata *ppd, struct qib_qsfp_cache *cp)
                qib_dev_porterr(ppd->dd, ppd->port,
                                "QSFP byte0 is 0x%02X, S/B 0x0C/D\n", peek[0]);
-        if ((peek[2] & 2) == 0) {
+        if ((peek[2] & 4) == 0) {
                /*
                 * If cable is paged, rather than "flat memory", we need to
                 * set the page to zero, Even if it already appears to be zero.
@@ -538,7 +538,7 @@ int qib_qsfp_dump(struct qib_pportdata *ppd, char *buf, int len)
        sofar += scnprintf(buf + sofar, len - sofar, "Date:%.*s\n",
                           QSFP_DATE_LEN, cd.date);
        sofar += scnprintf(buf + sofar, len - sofar, "Lot:%.*s\n",
-                           QSFP_LOT_LEN, cd.date);
+                           QSFP_LOT_LEN, cd.lot);
        while (bidx < QSFP_DEFAULT_HDR_CNT) {
                int iidx;
diff --git a/drivers/infiniband/hw/qib/qib_verbs.h b/drivers/infiniband/hw/qib/qib_verbs.h
index 2baf5ad251ed..bc803f33d5f6 100644
--- a/drivers/infiniband/hw/qib/qib_verbs.h
+++ b/drivers/infiniband/hw/qib/qib_verbs.h
@@ -329,9 +329,9 @@ struct qib_sge {
 struct qib_mr {
        struct ib_mr ibmr;
        struct ib_umem *umem;
-        struct qib_mregion mr;  /* must be last */
        u64 *pages;
        u32 npages;
+        struct qib_mregion mr;  /* must be last */
 };
 /*
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index a93070210109..42f4da620f2e 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -1293,7 +1293,7 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task,
                if (mr_status.fail_status & IB_MR_CHECK_SIG_STATUS) {
                        sector_t sector_off = mr_status.sig_err.sig_err_offset;
-                        do_div(sector_off, sector_size + 8);
+                        sector_div(sector_off, sector_size + 8);
                        *sector = scsi_get_lba(iser_task->sc) + sector_off;
                        pr_err("PI error found type %d at sector %llx "
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index dfbbbb28090b..8a51c3b5d657 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -157,16 +157,9 @@ isert_create_qp(struct isert_conn *isert_conn,
        attr.recv_cq = comp->cq;
        attr.cap.max_send_wr = ISERT_QP_MAX_REQ_DTOS;
        attr.cap.max_recv_wr = ISERT_QP_MAX_RECV_DTOS + 1;
-        /*
+        attr.cap.max_send_sge = device->dev_attr.max_sge;
-         * FIXME: Use devattr.max_sge - 2 for max_send_sge as
+        isert_conn->max_sge = min(device->dev_attr.max_sge,
-         * work-around for RDMA_READs with ConnectX-2.
+                                  device->dev_attr.max_sge_rd);
-         *
-         * Also, still make sure to have at least two SGEs for
-         * outgoing control PDU responses.
-         */
-        attr.cap.max_send_sge = max(2, device->dev_attr.max_sge - 2);
-        isert_conn->max_sge = attr.cap.max_send_sge;
        attr.cap.max_recv_sge = 1;
        attr.sq_sig_type = IB_SIGNAL_REQ_WR;
        attr.qp_type = IB_QPT_RC;
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 9909022dc6c3..3db9a659719b 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -488,7 +488,7 @@ static int srp_create_ch_ib(struct srp_rdma_ch *ch)
        struct ib_qp *qp;
        struct ib_fmr_pool *fmr_pool = NULL;
        struct srp_fr_pool *fr_pool = NULL;
-        const int m = 1 + dev->use_fast_reg;
+        const int m = dev->use_fast_reg ? 3 : 1;
        struct ib_cq_init_attr cq_attr = {};
        int ret;
@@ -994,16 +994,16 @@ static int srp_connect_ch(struct srp_rdma_ch *ch, bool multich)
        ret = srp_lookup_path(ch);
        if (ret)
-                return ret;
+                goto out;
        while (1) {
                init_completion(&ch->done);
                ret = srp_send_req(ch, multich);
                if (ret)
-                        return ret;
+                        goto out;
                ret = wait_for_completion_interruptible(&ch->done);
                if (ret < 0)
-                        return ret;
+                        goto out;
                /*
                 * The CM event handling code will set status to
@@ -1011,15 +1011,16 @@ static int srp_connect_ch(struct srp_rdma_ch *ch, bool multich)
                 * back, or SRP_DLID_REDIRECT if we get a lid/qp
                 * redirect REJ back.
                 */
-                switch (ch->status) {
+                ret = ch->status;
+                switch (ret) {
                case 0:
                        ch->connected = true;
-                        return 0;
+                        goto out;
                case SRP_PORT_REDIRECT:
                        ret = srp_lookup_path(ch);
                        if (ret)
-                                return ret;
+                                goto out;
                        break;
                case SRP_DLID_REDIRECT:
@@ -1028,13 +1029,16 @@ static int srp_connect_ch(struct srp_rdma_ch *ch, bool multich)
                case SRP_STALE_CONN:
                        shost_printk(KERN_ERR, target->scsi_host, PFX
                                     "giving up on stale connection\n");
-                        ch->status = -ECONNRESET;
+                        ret = -ECONNRESET;
-                        return ch->status;
+                        goto out;
                default:
-                        return ch->status;
+                        goto out;
                }
        }
+out:
+        return ret <= 0 ? ret : -ENODEV;
 }
 static int srp_inv_rkey(struct srp_rdma_ch *ch, u32 rkey)
@@ -1309,7 +1313,7 @@ reset_state:
 }
 static int srp_map_finish_fr(struct srp_map_state *state,
-                             struct srp_rdma_ch *ch)
+                             struct srp_rdma_ch *ch, int sg_nents)
 {
        struct srp_target_port *target = ch->target;
        struct srp_device *dev = target->srp_host->srp_dev;
@@ -1324,10 +1328,10 @@ static int srp_map_finish_fr(struct srp_map_state *state,
        WARN_ON_ONCE(!dev->use_fast_reg);
-        if (state->sg_nents == 0)
+        if (sg_nents == 0)
                return 0;
-        if (state->sg_nents == 1 && target->global_mr) {
+        if (sg_nents == 1 && target->global_mr) {
                srp_map_desc(state, sg_dma_address(state->sg),
                             sg_dma_len(state->sg),
                             target->global_mr->rkey);
@@ -1341,8 +1345,7 @@ static int srp_map_finish_fr(struct srp_map_state *state,
        rkey = ib_inc_rkey(desc->mr->rkey);
        ib_update_fast_reg_key(desc->mr, rkey);
-        n = ib_map_mr_sg(desc->mr, state->sg, state->sg_nents,
+        n = ib_map_mr_sg(desc->mr, state->sg, sg_nents, dev->mr_page_size);
-                         dev->mr_page_size);
        if (unlikely(n < 0))
                return n;
@@ -1448,16 +1451,15 @@ static int srp_map_sg_fr(struct srp_map_state *state, struct srp_rdma_ch *ch,
        state->fr.next = req->fr_list;
        state->fr.end = req->fr_list + ch->target->cmd_sg_cnt;
        state->sg = scat;
-        state->sg_nents = scsi_sg_count(req->scmnd);
-        while (state->sg_nents) {
+        while (count) {
                int i, n;
-                n = srp_map_finish_fr(state, ch);
+                n = srp_map_finish_fr(state, ch, count);
                if (unlikely(n < 0))
                        return n;
-                state->sg_nents -= n;
+                count -= n;
                for (i = 0; i < n; i++)
                        state->sg = sg_next(state->sg);
        }
@@ -1517,10 +1519,12 @@ static int srp_map_idb(struct srp_rdma_ch *ch, struct srp_request *req,
        if (dev->use_fast_reg) {
                state.sg = idb_sg;
-                state.sg_nents = 1;
                sg_set_buf(idb_sg, req->indirect_desc, idb_len);
                idb_sg->dma_address = req->indirect_dma_addr; /* hack! */
-                ret = srp_map_finish_fr(&state, ch);
+#ifdef CONFIG_NEED_SG_DMA_LENGTH
+                idb_sg->dma_length = idb_sg->length;          /* hack^2 */
+#endif
+                ret = srp_map_finish_fr(&state, ch, 1);
                if (ret < 0)
                        return ret;
        } else if (dev->use_fmr) {
@@ -1655,7 +1659,7 @@ static int srp_map_data(struct scsi_cmnd *scmnd, struct srp_rdma_ch *ch,
                        return ret;
                req->nmdesc++;
        } else {
-                idb_rkey = target->global_mr->rkey;
+                idb_rkey = cpu_to_be32(target->global_mr->rkey);
        }
        indirect_hdr->table_desc.va = cpu_to_be64(req->indirect_dma_addr);
diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h
index 87a2a919dc43..f6af531f9f32 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.h
+++ b/drivers/infiniband/ulp/srp/ib_srp.h
@@ -300,10 +300,7 @@ struct srp_map_state {
        dma_addr_t              base_dma_addr;
        u32                     dma_len;
        u32                     total_len;
-        union {
+        unsigned int            npages;
-                unsigned int    npages;
-                int             sg_nents;
-        };
        unsigned int            nmdesc;
        unsigned int            ndesc;
 };
diff --git a/drivers/irqchip/irq-versatile-fpga.c b/drivers/irqchip/irq-versatile-fpga.c
index 598ab3f0e0ac..cadf104e3074 100644
--- a/drivers/irqchip/irq-versatile-fpga.c
+++ b/drivers/irqchip/irq-versatile-fpga.c
@@ -210,7 +210,12 @@ int __init fpga_irq_of_init(struct device_node *node,
                parent_irq = -1;
        }
+#ifdef CONFIG_ARCH_VERSATILE
+        fpga_irq_init(base, node->name, IRQ_SIC_START, parent_irq, valid_mask,
+                                  node);
+#else
        fpga_irq_init(base, node->name, 0, parent_irq, valid_mask, node);
+#endif
        writel(clear_mask, base + IRQ_ENABLE_CLEAR);
        writel(clear_mask, base + FIQ_ENABLE_CLEAR);
diff --git a/drivers/lightnvm/Kconfig b/drivers/lightnvm/Kconfig
index a16bf56d3f28..85a339030e4b 100644
--- a/drivers/lightnvm/Kconfig
+++ b/drivers/lightnvm/Kconfig
@@ -18,6 +18,7 @@ if NVM
 config NVM_DEBUG
        bool "Open-Channel SSD debugging support"
+        default n
        ---help---
        Exposes a debug management interface to create/remove targets at:
diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
index 86ce887b2ed6..8f41b245cd55 100644
--- a/drivers/lightnvm/core.c
+++ b/drivers/lightnvm/core.c
@@ -74,7 +74,7 @@ EXPORT_SYMBOL(nvm_unregister_target);
 void *nvm_dev_dma_alloc(struct nvm_dev *dev, gfp_t mem_flags,
                                                        dma_addr_t *dma_handler)
 {
-        return dev->ops->dev_dma_alloc(dev->q, dev->ppalist_pool, mem_flags,
+        return dev->ops->dev_dma_alloc(dev, dev->ppalist_pool, mem_flags,
                                                                dma_handler);
 }
 EXPORT_SYMBOL(nvm_dev_dma_alloc);
@@ -97,15 +97,47 @@ static struct nvmm_type *nvm_find_mgr_type(const char *name)
        return NULL;
 }
+struct nvmm_type *nvm_init_mgr(struct nvm_dev *dev)
+{
+        struct nvmm_type *mt;
+        int ret;
+        lockdep_assert_held(&nvm_lock);
+        list_for_each_entry(mt, &nvm_mgrs, list) {
+                ret = mt->register_mgr(dev);
+                if (ret < 0) {
+                        pr_err("nvm: media mgr failed to init (%d) on dev %s\n",
+                                                                ret, dev->name);
+                        return NULL; /* initialization failed */
+                } else if (ret > 0)
+                        return mt;
+        }
+        return NULL;
+}
 int nvm_register_mgr(struct nvmm_type *mt)
 {
+        struct nvm_dev *dev;
        int ret = 0;
        down_write(&nvm_lock);
-        if (nvm_find_mgr_type(mt->name))
+        if (nvm_find_mgr_type(mt->name)) {
                ret = -EEXIST;
-        else
+                goto finish;
+        } else {
                list_add(&mt->list, &nvm_mgrs);
+        }
+        /* try to register media mgr if any device have none configured */
+        list_for_each_entry(dev, &nvm_devices, devices) {
+                if (dev->mt)
+                        continue;
+                dev->mt = nvm_init_mgr(dev);
+        }
+finish:
        up_write(&nvm_lock);
        return ret;
@@ -123,26 +155,6 @@ void nvm_unregister_mgr(struct nvmm_type *mt)
 }
 EXPORT_SYMBOL(nvm_unregister_mgr);
-/* register with device with a supported manager */
-static int register_mgr(struct nvm_dev *dev)
-{
-        struct nvmm_type *mt;
-        int ret = 0;
-        list_for_each_entry(mt, &nvm_mgrs, list) {
-                ret = mt->register_mgr(dev);
-                if (ret > 0) {
-                        dev->mt = mt;
-                        break; /* successfully initialized */
-                }
-        }
-        if (!ret)
-                pr_info("nvm: no compatible nvm manager found.\n");
-        return ret;
-}
 static struct nvm_dev *nvm_find_nvm_dev(const char *name)
 {
        struct nvm_dev *dev;
@@ -246,7 +258,7 @@ static int nvm_init(struct nvm_dev *dev)
        if (!dev->q || !dev->ops)
                return ret;
-        if (dev->ops->identity(dev->q, &dev->identity)) {
+        if (dev->ops->identity(dev, &dev->identity)) {
                pr_err("nvm: device could not be identified\n");
                goto err;
        }
@@ -271,14 +283,6 @@ static int nvm_init(struct nvm_dev *dev)
                goto err;
        }
-        down_write(&nvm_lock);
-        ret = register_mgr(dev);
-        up_write(&nvm_lock);
-        if (ret < 0)
-                goto err;
-        if (!ret)
-                return 0;
        pr_info("nvm: registered %s [%u/%u/%u/%u/%u/%u]\n",
                        dev->name, dev->sec_per_pg, dev->nr_planes,
                        dev->pgs_per_blk, dev->blks_per_lun, dev->nr_luns,
@@ -326,8 +330,7 @@ int nvm_register(struct request_queue *q, char *disk_name,
        }
        if (dev->ops->max_phys_sect > 1) {
-                dev->ppalist_pool = dev->ops->create_dma_pool(dev->q,
+                dev->ppalist_pool = dev->ops->create_dma_pool(dev, "ppalist");
-                                                                "ppalist");
                if (!dev->ppalist_pool) {
                        pr_err("nvm: could not create ppa pool\n");
                        ret = -ENOMEM;
@@ -335,7 +338,9 @@ int nvm_register(struct request_queue *q, char *disk_name,
                }
        }
+        /* register device with a supported media manager */
        down_write(&nvm_lock);
+        dev->mt = nvm_init_mgr(dev);
        list_add(&dev->devices, &nvm_devices);
        up_write(&nvm_lock);
@@ -380,19 +385,13 @@ static int nvm_create_target(struct nvm_dev *dev,
        struct nvm_tgt_type *tt;
        struct nvm_target *t;
        void *targetdata;
-        int ret = 0;
-        down_write(&nvm_lock);
        if (!dev->mt) {
-                ret = register_mgr(dev);
+                pr_info("nvm: device has no media manager registered.\n");
-                if (!ret)
+                return -ENODEV;
-                        ret = -ENODEV;
-                if (ret < 0) {
-                        up_write(&nvm_lock);
-                        return ret;
-                }
        }
+        down_write(&nvm_lock);
        tt = nvm_find_target_type(create->tgttype);
        if (!tt) {
                pr_err("nvm: target type %s not found\n", create->tgttype);
diff --git a/drivers/lightnvm/gennvm.c b/drivers/lightnvm/gennvm.c
index 35dde84b71e9..f434e89e1c7a 100644
--- a/drivers/lightnvm/gennvm.c
+++ b/drivers/lightnvm/gennvm.c
@@ -195,7 +195,7 @@ static int gennvm_blocks_init(struct nvm_dev *dev, struct gen_nvm *gn)
        }
        if (dev->ops->get_l2p_tbl) {
-                ret = dev->ops->get_l2p_tbl(dev->q, 0, dev->total_pages,
+                ret = dev->ops->get_l2p_tbl(dev, 0, dev->total_pages,
                                                        gennvm_block_map, dev);
                if (ret) {
                        pr_err("gennvm: could not read L2P table.\n");
@@ -219,6 +219,9 @@ static int gennvm_register(struct nvm_dev *dev)
        struct gen_nvm *gn;
        int ret;
+        if (!try_module_get(THIS_MODULE))
+                return -ENODEV;
        gn = kzalloc(sizeof(struct gen_nvm), GFP_KERNEL);
        if (!gn)
                return -ENOMEM;
@@ -242,12 +245,14 @@ static int gennvm_register(struct nvm_dev *dev)
        return 1;
 err:
        gennvm_free(dev);
+        module_put(THIS_MODULE);
        return ret;
 }
 static void gennvm_unregister(struct nvm_dev *dev)
 {
        gennvm_free(dev);
+        module_put(THIS_MODULE);
 }
 static struct nvm_block *gennvm_get_blk(struct nvm_dev *dev,
@@ -262,14 +267,11 @@ static struct nvm_block *gennvm_get_blk(struct nvm_dev *dev,
        if (list_empty(&lun->free_list)) {
                pr_err_ratelimited("gennvm: lun %u have no free pages available",
                                                                lun->vlun.id);
-                spin_unlock(&vlun->lock);
                goto out;
        }
-        while (!is_gc && lun->vlun.nr_free_blocks < lun->reserved_blocks) {
+        if (!is_gc && lun->vlun.nr_free_blocks < lun->reserved_blocks)
-                spin_unlock(&vlun->lock);
                goto out;
-        }
        blk = list_first_entry(&lun->free_list, struct nvm_block, list);
        list_move_tail(&blk->list, &lun->used_list);
@@ -278,8 +280,8 @@ static struct nvm_block *gennvm_get_blk(struct nvm_dev *dev,
        lun->vlun.nr_free_blocks--;
        lun->vlun.nr_inuse_blocks++;
-        spin_unlock(&vlun->lock);
 out:
+        spin_unlock(&vlun->lock);
        return blk;
 }
@@ -349,7 +351,7 @@ static int gennvm_submit_io(struct nvm_dev *dev, struct nvm_rq *rqd)
        gennvm_generic_to_addr_mode(dev, rqd);
        rqd->dev = dev;
-        return dev->ops->submit_io(dev->q, rqd);
+        return dev->ops->submit_io(dev, rqd);
 }
 static void gennvm_blk_set_type(struct nvm_dev *dev, struct ppa_addr *ppa,
@@ -385,7 +387,7 @@ static void gennvm_mark_blk_bad(struct nvm_dev *dev, struct nvm_rq *rqd)
        if (!dev->ops->set_bb_tbl)
                return;
-        if (dev->ops->set_bb_tbl(dev->q, rqd, 1))
+        if (dev->ops->set_bb_tbl(dev, rqd, 1))
                return;
        gennvm_addr_to_generic_mode(dev, rqd);
@@ -453,7 +455,7 @@ static int gennvm_erase_blk(struct nvm_dev *dev, struct nvm_block *blk,
        gennvm_generic_to_addr_mode(dev, &rqd);
-        ret = dev->ops->erase_block(dev->q, &rqd);
+        ret = dev->ops->erase_block(dev, &rqd);
        if (plane_cnt)
                nvm_dev_dma_free(dev, rqd.ppa_list, rqd.dma_ppa_list);
diff --git a/drivers/lightnvm/rrpc.c b/drivers/lightnvm/rrpc.c
index 75e59c3a3f96..134e4faba482 100644
--- a/drivers/lightnvm/rrpc.c
+++ b/drivers/lightnvm/rrpc.c
@@ -182,7 +182,7 @@ static struct rrpc_block *rrpc_get_blk(struct rrpc *rrpc, struct rrpc_lun *rlun,
        struct nvm_block *blk;
        struct rrpc_block *rblk;
-        blk = nvm_get_blk(rrpc->dev, rlun->parent, 0);
+        blk = nvm_get_blk(rrpc->dev, rlun->parent, flags);
        if (!blk)
                return NULL;
@@ -202,6 +202,20 @@ static void rrpc_put_blk(struct rrpc *rrpc, struct rrpc_block *rblk)
        nvm_put_blk(rrpc->dev, rblk->parent);
 }
+static void rrpc_put_blks(struct rrpc *rrpc)
+{
+        struct rrpc_lun *rlun;
+        int i;
+        for (i = 0; i < rrpc->nr_luns; i++) {
+                rlun = &rrpc->luns[i];
+                if (rlun->cur)
+                        rrpc_put_blk(rrpc, rlun->cur);
+                if (rlun->gc_cur)
+                        rrpc_put_blk(rrpc, rlun->gc_cur);
+        }
+}
 static struct rrpc_lun *get_next_lun(struct rrpc *rrpc)
 {
        int next = atomic_inc_return(&rrpc->next_lun);
@@ -1002,7 +1016,7 @@ static int rrpc_map_init(struct rrpc *rrpc)
                return 0;
        /* Bring up the mapping table from device */
-        ret = dev->ops->get_l2p_tbl(dev->q, 0, dev->total_pages,
+        ret = dev->ops->get_l2p_tbl(dev, 0, dev->total_pages,
                                                        rrpc_l2p_update, rrpc);
        if (ret) {
                pr_err("nvm: rrpc: could not read L2P table.\n");
@@ -1224,18 +1238,21 @@ static int rrpc_luns_configure(struct rrpc *rrpc)
                rblk = rrpc_get_blk(rrpc, rlun, 0);
                if (!rblk)
-                        return -EINVAL;
+                        goto err;
                rrpc_set_lun_cur(rlun, rblk);
                /* Emergency gc block */
                rblk = rrpc_get_blk(rrpc, rlun, 1);
                if (!rblk)
-                        return -EINVAL;
+                        goto err;
                rlun->gc_cur = rblk;
        }
        return 0;
+err:
+        rrpc_put_blks(rrpc);
+        return -EINVAL;
 }
 static struct nvm_tgt_type tt_rrpc;
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 1fa45695b68a..c219a053c7f6 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -1207,6 +1207,12 @@ static int __reserve_metadata_snap(struct dm_pool_metadata *pmd)
        dm_block_t held_root;
        /*
+         * We commit to ensure the btree roots which we increment in a
+         * moment are up to date.
+         */
+        __commit_transaction(pmd);
+        /*
         * Copy the superblock.
         */
        dm_sm_inc_block(pmd->metadata_sm, THIN_SUPERBLOCK_LOCATION);
@@ -1538,7 +1544,7 @@ static int __remove(struct dm_thin_device *td, dm_block_t block)
 static int __remove_range(struct dm_thin_device *td, dm_block_t begin, dm_block_t end)
 {
        int r;
-        unsigned count;
+        unsigned count, total_count = 0;
        struct dm_pool_metadata *pmd = td->pmd;
        dm_block_t keys[1] = { td->id };
        __le64 value;
@@ -1561,11 +1567,29 @@ static int __remove_range(struct dm_thin_device *td, dm_block_t begin, dm_block_
        if (r)
                return r;
-        r = dm_btree_remove_leaves(&pmd->bl_info, mapping_root, &begin, end, &mapping_root, &count);
+        /*
-        if (r)
+         * Remove leaves stops at the first unmapped entry, so we have to
-                return r;
+         * loop round finding mapped ranges.
+         */
+        while (begin < end) {
+                r = dm_btree_lookup_next(&pmd->bl_info, mapping_root, &begin, &begin, &value);
+                if (r == -ENODATA)
+                        break;
+                if (r)
+                        return r;
+                if (begin >= end)
+                        break;
+                r = dm_btree_remove_leaves(&pmd->bl_info, mapping_root, &begin, end, &mapping_root, &count);
+                if (r)
+                        return r;
+                total_count += count;
+        }
-        td->mapped_blocks -= count;
+        td->mapped_blocks -= total_count;
        td->changed = 1;
        /*
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 807095f4c793..96a991821ae6 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -34,6 +34,7 @@
 #include <linux/kthread.h>
 #include <linux/blkdev.h>
+#include <linux/badblocks.h>
 #include <linux/sysctl.h>
 #include <linux/seq_file.h>
 #include <linux/fs.h>
@@ -709,8 +710,7 @@ void md_rdev_clear(struct md_rdev *rdev)
                put_page(rdev->bb_page);
                rdev->bb_page = NULL;
        }
-        kfree(rdev->badblocks.page);
+        badblocks_exit(&rdev->badblocks);
-        rdev->badblocks.page = NULL;
 }
 EXPORT_SYMBOL_GPL(md_rdev_clear);
@@ -1360,8 +1360,6 @@ static __le32 calc_sb_1_csum(struct mdp_superblock_1 *sb)
        return cpu_to_le32(csum);
 }
-static int md_set_badblocks(struct badblocks *bb, sector_t s, int sectors,
-                            int acknowledged);
 static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_version)
 {
        struct mdp_superblock_1 *sb;
@@ -1486,8 +1484,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
                        count <<= sb->bblog_shift;
                        if (bb + 1 == 0)
                                break;
-                        if (md_set_badblocks(&rdev->badblocks,
+                        if (badblocks_set(&rdev->badblocks, sector, count, 1))
-                                             sector, count, 1) == 0)
                                return -EINVAL;
                }
        } else if (sb->bblog_offset != 0)
@@ -2319,7 +2316,7 @@ repeat:
                        rdev_for_each(rdev, mddev) {
                                if (rdev->badblocks.changed) {
                                        rdev->badblocks.changed = 0;
-                                        md_ack_all_badblocks(&rdev->badblocks);
+                                        ack_all_badblocks(&rdev->badblocks);
                                        md_error(mddev, rdev);
                                }
                                clear_bit(Blocked, &rdev->flags);
@@ -2445,7 +2442,7 @@ repeat:
                        clear_bit(Blocked, &rdev->flags);
                if (any_badblocks_changed)
-                        md_ack_all_badblocks(&rdev->badblocks);
+                        ack_all_badblocks(&rdev->badblocks);
                clear_bit(BlockedBadBlocks, &rdev->flags);
                wake_up(&rdev->blocked_wait);
        }
@@ -3046,11 +3043,17 @@ static ssize_t recovery_start_store(struct md_rdev *rdev, const char *buf, size_
 static struct rdev_sysfs_entry rdev_recovery_start =
 __ATTR(recovery_start, S_IRUGO|S_IWUSR, recovery_start_show, recovery_start_store);
-static ssize_t
+/* sysfs access to bad-blocks list.
-badblocks_show(struct badblocks *bb, char *page, int unack);
+ * We present two files.
-static ssize_t
+ * 'bad-blocks' lists sector numbers and lengths of ranges that
-badblocks_store(struct badblocks *bb, const char *page, size_t len, int unack);
+ *    are recorded as bad.  The list is truncated to fit within
+ *    the one-page limit of sysfs.
+ *    Writing "sector length" to this file adds an acknowledged
+ *    bad block list.
+ * 'unacknowledged-bad-blocks' lists bad blocks that have not yet
+ *    been acknowledged.  Writing to this file adds bad blocks
+ *    without acknowledging them.  This is largely for testing.
+ */
 static ssize_t bb_show(struct md_rdev *rdev, char *page)
 {
        return badblocks_show(&rdev->badblocks, page, 0);
@@ -3165,14 +3168,7 @@ int md_rdev_init(struct md_rdev *rdev)
         * This reserves the space even on arrays where it cannot
         * be used - I wonder if that matters
         */
-        rdev->badblocks.count = 0;
+        return badblocks_init(&rdev->badblocks, 0);
-        rdev->badblocks.shift = -1; /* disabled until explicitly enabled */
-        rdev->badblocks.page = kmalloc(PAGE_SIZE, GFP_KERNEL);
-        seqlock_init(&rdev->badblocks.lock);
-        if (rdev->badblocks.page == NULL)
-                return -ENOMEM;
-        return 0;
 }
 EXPORT_SYMBOL_GPL(md_rdev_init);
 /*
@@ -8478,254 +8474,9 @@ void md_finish_reshape(struct mddev *mddev)
 }
 EXPORT_SYMBOL(md_finish_reshape);
-/* Bad block management.
+/* Bad block management */
- * We can record which blocks on each device are 'bad' and so just
- * fail those blocks, or that stripe, rather than the whole device.
- * Entries in the bad-block table are 64bits wide.  This comprises:
- * Length of bad-range, in sectors: 0-511 for lengths 1-512
- * Start of bad-range, sector offset, 54 bits (allows 8 exbibytes)
- *  A 'shift' can be set so that larger blocks are tracked and
- *  consequently larger devices can be covered.
- * 'Acknowledged' flag - 1 bit. - the most significant bit.
- *
- * Locking of the bad-block table uses a seqlock so md_is_badblock
- * might need to retry if it is very unlucky.
- * We will sometimes want to check for bad blocks in a bi_end_io function,
- * so we use the write_seqlock_irq variant.
- *
- * When looking for a bad block we specify a range and want to
- * know if any block in the range is bad.  So we binary-search
- * to the last range that starts at-or-before the given endpoint,
- * (or "before the sector after the target range")
- * then see if it ends after the given start.
- * We return
- *  0 if there are no known bad blocks in the range
- *  1 if there are known bad block which are all acknowledged
- * -1 if there are bad blocks which have not yet been acknowledged in metadata.
- * plus the start/length of the first bad section we overlap.
- */
-int md_is_badblock(struct badblocks *bb, sector_t s, int sectors,
-                   sector_t *first_bad, int *bad_sectors)
-{
-        int hi;
-        int lo;
-        u64 *p = bb->page;
-        int rv;
-        sector_t target = s + sectors;
-        unsigned seq;
-        if (bb->shift > 0) {
-                /* round the start down, and the end up */
-                s >>= bb->shift;
-                target += (1<<bb->shift) - 1;
-                target >>= bb->shift;
-                sectors = target - s;
-        }
-        /* 'target' is now the first block after the bad range */
-retry:
-        seq = read_seqbegin(&bb->lock);
-        lo = 0;
-        rv = 0;
-        hi = bb->count;
-        /* Binary search between lo and hi for 'target'
-         * i.e. for the last range that starts before 'target'
-         */
-        /* INVARIANT: ranges before 'lo' and at-or-after 'hi'
-         * are known not to be the last range before target.
-         * VARIANT: hi-lo is the number of possible
-         * ranges, and decreases until it reaches 1
-         */
-        while (hi - lo > 1) {
-                int mid = (lo + hi) / 2;
-                sector_t a = BB_OFFSET(p[mid]);
-                if (a < target)
-                        /* This could still be the one, earlier ranges
-                         * could not. */
-                        lo = mid;
-                else
-                        /* This and later ranges are definitely out. */
-                        hi = mid;
-        }
-        /* 'lo' might be the last that started before target, but 'hi' isn't */
-        if (hi > lo) {
-                /* need to check all range that end after 's' to see if
-                 * any are unacknowledged.
-                 */
-                while (lo >= 0 &&
-                       BB_OFFSET(p[lo]) + BB_LEN(p[lo]) > s) {
-                        if (BB_OFFSET(p[lo]) < target) {
-                                /* starts before the end, and finishes after
-                                 * the start, so they must overlap
-                                 */
-                                if (rv != -1 && BB_ACK(p[lo]))
-                                        rv = 1;
-                                else
-                                        rv = -1;
-                                *first_bad = BB_OFFSET(p[lo]);
-                                *bad_sectors = BB_LEN(p[lo]);
-                        }
-                        lo--;
-                }
-        }
-        if (read_seqretry(&bb->lock, seq))
-                goto retry;
-        return rv;
-}
-EXPORT_SYMBOL_GPL(md_is_badblock);
-/*
- * Add a range of bad blocks to the table.
- * This might extend the table, or might contract it
- * if two adjacent ranges can be merged.
- * We binary-search to find the 'insertion' point, then
- * decide how best to handle it.
- */
-static int md_set_badblocks(struct badblocks *bb, sector_t s, int sectors,
-                            int acknowledged)
-{
-        u64 *p;
-        int lo, hi;
-        int rv = 1;
-        unsigned long flags;
-        if (bb->shift < 0)
-                /* badblocks are disabled */
-                return 0;
-        if (bb->shift) {
-                /* round the start down, and the end up */
-                sector_t next = s + sectors;
-                s >>= bb->shift;
-                next += (1<<bb->shift) - 1;
-                next >>= bb->shift;
-                sectors = next - s;
-        }
-        write_seqlock_irqsave(&bb->lock, flags);
-        p = bb->page;
-        lo = 0;
-        hi = bb->count;
-        /* Find the last range that starts at-or-before 's' */
-        while (hi - lo > 1) {
-                int mid = (lo + hi) / 2;
-                sector_t a = BB_OFFSET(p[mid]);
-                if (a <= s)
-                        lo = mid;
-                else
-                        hi = mid;
-        }
-        if (hi > lo && BB_OFFSET(p[lo]) > s)
-                hi = lo;
-        if (hi > lo) {
-                /* we found a range that might merge with the start
-                 * of our new range
-                 */
-                sector_t a = BB_OFFSET(p[lo]);
-                sector_t e = a + BB_LEN(p[lo]);
-                int ack = BB_ACK(p[lo]);
-                if (e >= s) {
-                        /* Yes, we can merge with a previous range */
-                        if (s == a && s + sectors >= e)
-                                /* new range covers old */
-                                ack = acknowledged;
-                        else
-                                ack = ack && acknowledged;
-                        if (e < s + sectors)
-                                e = s + sectors;
-                        if (e - a <= BB_MAX_LEN) {
-                                p[lo] = BB_MAKE(a, e-a, ack);
-                                s = e;
-                        } else {
-                                /* does not all fit in one range,
-                                 * make p[lo] maximal
-                                 */
-                                if (BB_LEN(p[lo]) != BB_MAX_LEN)
-                                        p[lo] = BB_MAKE(a, BB_MAX_LEN, ack);
-                                s = a + BB_MAX_LEN;
-                        }
-                        sectors = e - s;
-                }
-        }
-        if (sectors && hi < bb->count) {
-                /* 'hi' points to the first range that starts after 's'.
-                 * Maybe we can merge with the start of that range */
-                sector_t a = BB_OFFSET(p[hi]);
-                sector_t e = a + BB_LEN(p[hi]);
-                int ack = BB_ACK(p[hi]);
-                if (a <= s + sectors) {
-                        /* merging is possible */
-                        if (e <= s + sectors) {
-                                /* full overlap */
-                                e = s + sectors;
-                                ack = acknowledged;
-                        } else
-                                ack = ack && acknowledged;
-                        a = s;
-                        if (e - a <= BB_MAX_LEN) {
-                                p[hi] = BB_MAKE(a, e-a, ack);
-                                s = e;
-                        } else {
-                                p[hi] = BB_MAKE(a, BB_MAX_LEN, ack);
-                                s = a + BB_MAX_LEN;
-                        }
-                        sectors = e - s;
-                        lo = hi;
-                        hi++;
-                }
-        }
-        if (sectors == 0 && hi < bb->count) {
-                /* we might be able to combine lo and hi */
-                /* Note: 's' is at the end of 'lo' */
-                sector_t a = BB_OFFSET(p[hi]);
-                int lolen = BB_LEN(p[lo]);
-                int hilen = BB_LEN(p[hi]);
-                int newlen = lolen + hilen - (s - a);
-                if (s >= a && newlen < BB_MAX_LEN) {
-                        /* yes, we can combine them */
-                        int ack = BB_ACK(p[lo]) && BB_ACK(p[hi]);
-                        p[lo] = BB_MAKE(BB_OFFSET(p[lo]), newlen, ack);
-                        memmove(p + hi, p + hi + 1,
-                                (bb->count - hi - 1) * 8);
-                        bb->count--;
-                }
-        }
-        while (sectors) {
-                /* didn't merge (it all).
-                 * Need to add a range just before 'hi' */
-                if (bb->count >= MD_MAX_BADBLOCKS) {
-                        /* No room for more */
-                        rv = 0;
-                        break;
-                } else {
-                        int this_sectors = sectors;
-                        memmove(p + hi + 1, p + hi,
-                                (bb->count - hi) * 8);
-                        bb->count++;
-                        if (this_sectors > BB_MAX_LEN)
-                                this_sectors = BB_MAX_LEN;
-                        p[hi] = BB_MAKE(s, this_sectors, acknowledged);
-                        sectors -= this_sectors;
-                        s += this_sectors;
-                }
-        }
-        bb->changed = 1;
-        if (!acknowledged)
-                bb->unacked_exist = 1;
-        write_sequnlock_irqrestore(&bb->lock, flags);
-        return rv;
-}
+/* Returns 1 on success, 0 on failure */
 int rdev_set_badblocks(struct md_rdev *rdev, sector_t s, int sectors,
                       int is_new)
 {
@@ -8734,114 +8485,19 @@ int rdev_set_badblocks(struct md_rdev *rdev, sector_t s, int sectors,
                s += rdev->new_data_offset;
        else
                s += rdev->data_offset;
-        rv = md_set_badblocks(&rdev->badblocks,
+        rv = badblocks_set(&rdev->badblocks, s, sectors, 0);
-                              s, sectors, 0);
+        if (rv == 0) {
-        if (rv) {
                /* Make sure they get written out promptly */
                sysfs_notify_dirent_safe(rdev->sysfs_state);
                set_bit(MD_CHANGE_CLEAN, &rdev->mddev->flags);
                set_bit(MD_CHANGE_PENDING, &rdev->mddev->flags);
                md_wakeup_thread(rdev->mddev->thread);
-        }
+                return 1;
-        return rv;
+        } else
+                return 0;
 }
 EXPORT_SYMBOL_GPL(rdev_set_badblocks);
-/*
- * Remove a range of bad blocks from the table.
- * This may involve extending the table if we spilt a region,
- * but it must not fail.  So if the table becomes full, we just
- * drop the remove request.
- */
-static int md_clear_badblocks(struct badblocks *bb, sector_t s, int sectors)
-{
-        u64 *p;
-        int lo, hi;
-        sector_t target = s + sectors;
-        int rv = 0;
-        if (bb->shift > 0) {
-                /* When clearing we round the start up and the end down.
-                 * This should not matter as the shift should align with
-                 * the block size and no rounding should ever be needed.
-                 * However it is better the think a block is bad when it
-                 * isn't than to think a block is not bad when it is.
-                 */
-                s += (1<<bb->shift) - 1;
-                s >>= bb->shift;
-                target >>= bb->shift;
-                sectors = target - s;
-        }
-        write_seqlock_irq(&bb->lock);
-        p = bb->page;
-        lo = 0;
-        hi = bb->count;
-        /* Find the last range that starts before 'target' */
-        while (hi - lo > 1) {
-                int mid = (lo + hi) / 2;
-                sector_t a = BB_OFFSET(p[mid]);
-                if (a < target)
-                        lo = mid;
-                else
-                        hi = mid;
-        }
-        if (hi > lo) {
-                /* p[lo] is the last range that could overlap the
-                 * current range.  Earlier ranges could also overlap,
-                 * but only this one can overlap the end of the range.
-                 */
-                if (BB_OFFSET(p[lo]) + BB_LEN(p[lo]) > target) {
-                        /* Partial overlap, leave the tail of this range */
-                        int ack = BB_ACK(p[lo]);
-                        sector_t a = BB_OFFSET(p[lo]);
-                        sector_t end = a + BB_LEN(p[lo]);
-                        if (a < s) {
-                                /* we need to split this range */
-                                if (bb->count >= MD_MAX_BADBLOCKS) {
-                                        rv = -ENOSPC;
-                                        goto out;
-                                }
-                                memmove(p+lo+1, p+lo, (bb->count - lo) * 8);
-                                bb->count++;
-                                p[lo] = BB_MAKE(a, s-a, ack);
-                                lo++;
-                        }
-                        p[lo] = BB_MAKE(target, end - target, ack);
-                        /* there is no longer an overlap */
-                        hi = lo;
-                        lo--;
-                }
-                while (lo >= 0 &&
-                       BB_OFFSET(p[lo]) + BB_LEN(p[lo]) > s) {
-                        /* This range does overlap */
-                        if (BB_OFFSET(p[lo]) < s) {
-                                /* Keep the early parts of this range. */
-                                int ack = BB_ACK(p[lo]);
-                                sector_t start = BB_OFFSET(p[lo]);
-                                p[lo] = BB_MAKE(start, s - start, ack);
-                                /* now low doesn't overlap, so.. */
-                                break;
-                        }
-                        lo--;
-                }
-                /* 'lo' is strictly before, 'hi' is strictly after,
-                 * anything between needs to be discarded
-                 */
-                if (hi - lo > 1) {
-                        memmove(p+lo+1, p+hi, (bb->count - hi) * 8);
-                        bb->count -= (hi - lo - 1);
-                }
-        }
-        bb->changed = 1;
-out:
-        write_sequnlock_irq(&bb->lock);
-        return rv;
-}
 int rdev_clear_badblocks(struct md_rdev *rdev, sector_t s, int sectors,
                         int is_new)
 {
@@ -8849,133 +8505,11 @@ int rdev_clear_badblocks(struct md_rdev *rdev, sector_t s, int sectors,
                s += rdev->new_data_offset;
        else
                s += rdev->data_offset;
-        return md_clear_badblocks(&rdev->badblocks,
+        return badblocks_clear(&rdev->badblocks,
                                  s, sectors);
 }
 EXPORT_SYMBOL_GPL(rdev_clear_badblocks);
-/*
- * Acknowledge all bad blocks in a list.
- * This only succeeds if ->changed is clear.  It is used by
- * in-kernel metadata updates
- */
-void md_ack_all_badblocks(struct badblocks *bb)
-{
-        if (bb->page == NULL || bb->changed)
-                /* no point even trying */
-                return;
-        write_seqlock_irq(&bb->lock);
-        if (bb->changed == 0 && bb->unacked_exist) {
-                u64 *p = bb->page;
-                int i;
-                for (i = 0; i < bb->count ; i++) {
-                        if (!BB_ACK(p[i])) {
-                                sector_t start = BB_OFFSET(p[i]);
-                                int len = BB_LEN(p[i]);
-                                p[i] = BB_MAKE(start, len, 1);
-                        }
-                }
-                bb->unacked_exist = 0;
-        }
-        write_sequnlock_irq(&bb->lock);
-}
-EXPORT_SYMBOL_GPL(md_ack_all_badblocks);
-/* sysfs access to bad-blocks list.
- * We present two files.
- * 'bad-blocks' lists sector numbers and lengths of ranges that
- *    are recorded as bad.  The list is truncated to fit within
- *    the one-page limit of sysfs.
- *    Writing "sector length" to this file adds an acknowledged
- *    bad block list.
- * 'unacknowledged-bad-blocks' lists bad blocks that have not yet
- *    been acknowledged.  Writing to this file adds bad blocks
- *    without acknowledging them.  This is largely for testing.
- */
-static ssize_t
-badblocks_show(struct badblocks *bb, char *page, int unack)
-{
-        size_t len;
-        int i;
-        u64 *p = bb->page;
-        unsigned seq;
-        if (bb->shift < 0)
-                return 0;
-retry:
-        seq = read_seqbegin(&bb->lock);
-        len = 0;
-        i = 0;
-        while (len < PAGE_SIZE && i < bb->count) {
-                sector_t s = BB_OFFSET(p[i]);
-                unsigned int length = BB_LEN(p[i]);
-                int ack = BB_ACK(p[i]);
-                i++;
-                if (unack && ack)
-                        continue;
-                len += snprintf(page+len, PAGE_SIZE-len, "%llu %u\n",
-                                (unsigned long long)s << bb->shift,
-                                length << bb->shift);
-        }
-        if (unack && len == 0)
-                bb->unacked_exist = 0;
-        if (read_seqretry(&bb->lock, seq))
-                goto retry;
-        return len;
-}
-#define DO_DEBUG 1
-static ssize_t
-badblocks_store(struct badblocks *bb, const char *page, size_t len, int unack)
-{
-        unsigned long long sector;
-        int length;
-        char newline;
-#ifdef DO_DEBUG
-        /* Allow clearing via sysfs *only* for testing/debugging.
-         * Normally only a successful write may clear a badblock
-         */
-        int clear = 0;
-        if (page[0] == '-') {
-                clear = 1;
-                page++;
-        }
-#endif /* DO_DEBUG */
-        switch (sscanf(page, "%llu %d%c", &sector, &length, &newline)) {
-        case 3:
-                if (newline != '\n')
-                        return -EINVAL;
-        case 2:
-                if (length <= 0)
-                        return -EINVAL;
-                break;
-        default:
-                return -EINVAL;
-        }
-#ifdef DO_DEBUG
-        if (clear) {
-                md_clear_badblocks(bb, sector, length);
-                return len;
-        }
-#endif /* DO_DEBUG */
-        if (md_set_badblocks(bb, sector, length, !unack))
-                return len;
-        else
-                return -ENOSPC;
-}
 static int md_notify_reboot(struct notifier_block *this,
                            unsigned long code, void *x)
 {
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 2bea51edfab7..389afc420db6 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -17,6 +17,7 @@
 #include <linux/blkdev.h>
 #include <linux/backing-dev.h>
+#include <linux/badblocks.h>
 #include <linux/kobject.h>
 #include <linux/list.h>
 #include <linux/mm.h>
@@ -28,13 +29,6 @@
 #define MaxSector (~(sector_t)0)
-/* Bad block numbers are stored sorted in a single page.
- * 64bits is used for each block or extent.
- * 54 bits are sector number, 9 bits are extent size,
- * 1 bit is an 'acknowledged' flag.
- */
-#define MD_MAX_BADBLOCKS        (PAGE_SIZE/8)
 /*
 * MD's 'extended' device
 */
@@ -117,22 +111,7 @@ struct md_rdev {
        struct kernfs_node *sysfs_state; /* handle for 'state'
                                           * sysfs entry */
-        struct badblocks {
+        struct badblocks badblocks;
-                int     count;          /* count of bad blocks */
-                int     unacked_exist;  /* there probably are unacknowledged
-                                         * bad blocks.  This is only cleared
-                                         * when a read discovers none
-                                         */
-                int     shift;          /* shift from sectors to block size
-                                         * a -ve shift means badblocks are
-                                         * disabled.*/
-                u64     *page;          /* badblock list */
-                int     changed;
-                seqlock_t lock;
-                sector_t sector;
-                sector_t size;          /* in sectors */
-        } badblocks;
 };
 enum flag_bits {
        Faulty,                 /* device is known to have a fault */
@@ -185,22 +164,11 @@ enum flag_bits {
                                 */
 };
-#define BB_LEN_MASK     (0x00000000000001FFULL)
-#define BB_OFFSET_MASK  (0x7FFFFFFFFFFFFE00ULL)
-#define BB_ACK_MASK     (0x8000000000000000ULL)
-#define BB_MAX_LEN      512
-#define BB_OFFSET(x)    (((x) & BB_OFFSET_MASK) >> 9)
-#define BB_LEN(x)       (((x) & BB_LEN_MASK) + 1)
-#define BB_ACK(x)       (!!((x) & BB_ACK_MASK))
-#define BB_MAKE(a, l, ack) (((a)<<9) | ((l)-1) | ((u64)(!!(ack)) << 63))
-extern int md_is_badblock(struct badblocks *bb, sector_t s, int sectors,
-                          sector_t *first_bad, int *bad_sectors);
 static inline int is_badblock(struct md_rdev *rdev, sector_t s, int sectors,
                              sector_t *first_bad, int *bad_sectors)
 {
        if (unlikely(rdev->badblocks.count)) {
-                int rv = md_is_badblock(&rdev->badblocks, rdev->data_offset + s,
+                int rv = badblocks_check(&rdev->badblocks, rdev->data_offset + s,
                                        sectors,
                                        first_bad, bad_sectors);
                if (rv)
@@ -213,8 +181,6 @@ extern int rdev_set_badblocks(struct md_rdev *rdev, sector_t s, int sectors,
                              int is_new);
 extern int rdev_clear_badblocks(struct md_rdev *rdev, sector_t s, int sectors,
                                int is_new);
-extern void md_ack_all_badblocks(struct badblocks *bb);
 struct md_cluster_info;
 struct mddev {
diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index c573402033b2..b1ced58eb5e1 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -63,6 +63,11 @@ int lower_bound(struct btree_node *n, uint64_t key)
        return bsearch(n, key, 0);
 }
+static int upper_bound(struct btree_node *n, uint64_t key)
+{
+        return bsearch(n, key, 1);
+}
 void inc_children(struct dm_transaction_manager *tm, struct btree_node *n,
                  struct dm_btree_value_type *vt)
 {
@@ -252,6 +257,16 @@ static void pop_frame(struct del_stack *s)
        dm_tm_unlock(s->tm, f->b);
 }
+static void unlock_all_frames(struct del_stack *s)
+{
+        struct frame *f;
+        while (unprocessed_frames(s)) {
+                f = s->spine + s->top--;
+                dm_tm_unlock(s->tm, f->b);
+        }
+}
 int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
 {
        int r;
@@ -308,9 +323,13 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
                        pop_frame(s);
                }
        }
 out:
+        if (r) {
+                /* cleanup all frames of del_stack */
+                unlock_all_frames(s);
+        }
        kfree(s);
        return r;
 }
 EXPORT_SYMBOL_GPL(dm_btree_del);
@@ -392,6 +411,82 @@ int dm_btree_lookup(struct dm_btree_info *info, dm_block_t root,
 }
 EXPORT_SYMBOL_GPL(dm_btree_lookup);
+static int dm_btree_lookup_next_single(struct dm_btree_info *info, dm_block_t root,
+                                       uint64_t key, uint64_t *rkey, void *value_le)
+{
+        int r, i;
+        uint32_t flags, nr_entries;
+        struct dm_block *node;
+        struct btree_node *n;
+        r = bn_read_lock(info, root, &node);
+        if (r)
+                return r;
+        n = dm_block_data(node);
+        flags = le32_to_cpu(n->header.flags);
+        nr_entries = le32_to_cpu(n->header.nr_entries);
+        if (flags & INTERNAL_NODE) {
+                i = lower_bound(n, key);
+                if (i < 0 || i >= nr_entries) {
+                        r = -ENODATA;
+                        goto out;
+                }
+                r = dm_btree_lookup_next_single(info, value64(n, i), key, rkey, value_le);
+                if (r == -ENODATA && i < (nr_entries - 1)) {
+                        i++;
+                        r = dm_btree_lookup_next_single(info, value64(n, i), key, rkey, value_le);
+                }
+        } else {
+                i = upper_bound(n, key);
+                if (i < 0 || i >= nr_entries) {
+                        r = -ENODATA;
+                        goto out;
+                }
+                *rkey = le64_to_cpu(n->keys[i]);
+                memcpy(value_le, value_ptr(n, i), info->value_type.size);
+        }
+out:
+        dm_tm_unlock(info->tm, node);
+        return r;
+}
+int dm_btree_lookup_next(struct dm_btree_info *info, dm_block_t root,
+                         uint64_t *keys, uint64_t *rkey, void *value_le)
+{
+        unsigned level;
+        int r = -ENODATA;
+        __le64 internal_value_le;
+        struct ro_spine spine;
+        init_ro_spine(&spine, info);
+        for (level = 0; level < info->levels - 1u; level++) {
+                r = btree_lookup_raw(&spine, root, keys[level],
+                                     lower_bound, rkey,
+                                     &internal_value_le, sizeof(uint64_t));
+                if (r)
+                        goto out;
+                if (*rkey != keys[level]) {
+                        r = -ENODATA;
+                        goto out;
+                }
+                root = le64_to_cpu(internal_value_le);
+        }
+        r = dm_btree_lookup_next_single(info, root, keys[level], rkey, value_le);
+out:
+        exit_ro_spine(&spine);
+        return r;
+}
+EXPORT_SYMBOL_GPL(dm_btree_lookup_next);
 /*
 * Splits a node by creating a sibling node and shifting half the nodes
 * contents across.  Assumes there is a parent node, and it has room for
@@ -473,8 +568,10 @@ static int btree_split_sibling(struct shadow_spine *s, unsigned parent_index,
        r = insert_at(sizeof(__le64), pn, parent_index + 1,
                      le64_to_cpu(rn->keys[0]), &location);
-        if (r)
+        if (r) {
+                unlock_block(s->info, right);
                return r;
+        }
        if (key < le64_to_cpu(rn->keys[0])) {
                unlock_block(s->info, right);
diff --git a/drivers/md/persistent-data/dm-btree.h b/drivers/md/persistent-data/dm-btree.h
index 11d8cf78621d..c74301fa5a37 100644
--- a/drivers/md/persistent-data/dm-btree.h
+++ b/drivers/md/persistent-data/dm-btree.h
@@ -110,6 +110,13 @@ int dm_btree_lookup(struct dm_btree_info *info, dm_block_t root,
                    uint64_t *keys, void *value_le);
 /*
+ * Tries to find the first key where the bottom level key is >= to that
+ * given.  Useful for skipping empty sections of the btree.
+ */
+int dm_btree_lookup_next(struct dm_btree_info *info, dm_block_t root,
+                         uint64_t *keys, uint64_t *rkey, void *value_le);
+/*
 * Insertion (or overwrite an existing value).  O(ln(n))
 */
 int dm_btree_insert(struct dm_btree_info *info, dm_block_t root,
@@ -135,9 +142,10 @@ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
                    uint64_t *keys, dm_block_t *new_root);
 /*
- * Removes values between 'keys' and keys2, where keys2 is keys with the
+ * Removes a _contiguous_ run of values starting from 'keys' and not
- * final key replaced with 'end_key'.  'end_key' is the one-past-the-end
+ * reaching keys2 (where keys2 is keys with the final key replaced with
- * value.  'keys' may be altered.
+ * 'end_key').  'end_key' is the one-past-the-end value.  'keys' may be
+ * altered.
 */
 int dm_btree_remove_leaves(struct dm_btree_info *info, dm_block_t root,
                           uint64_t *keys, uint64_t end_key,
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index 53091295fce9..fca6dbcf9a47 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -136,7 +136,7 @@ static int brb_push(struct bop_ring_buffer *brb,
        return 0;
 }
-static int brb_pop(struct bop_ring_buffer *brb, struct block_op *result)
+static int brb_peek(struct bop_ring_buffer *brb, struct block_op *result)
 {
        struct block_op *bop;
@@ -147,6 +147,17 @@ static int brb_pop(struct bop_ring_buffer *brb, struct block_op *result)
        result->type = bop->type;
        result->block = bop->block;
+        return 0;
+}
+static int brb_pop(struct bop_ring_buffer *brb)
+{
+        struct block_op *bop;
+        if (brb_empty(brb))
+                return -ENODATA;
+        bop = brb->bops + brb->begin;
        brb->begin = brb_next(brb, brb->begin);
        return 0;
@@ -211,7 +222,7 @@ static int apply_bops(struct sm_metadata *smm)
        while (!brb_empty(&smm->uncommitted)) {
                struct block_op bop;
-                r = brb_pop(&smm->uncommitted, &bop);
+                r = brb_peek(&smm->uncommitted, &bop);
                if (r) {
                        DMERR("bug in bop ring buffer");
                        break;
@@ -220,6 +231,8 @@ static int apply_bops(struct sm_metadata *smm)
                r = commit_bop(smm, &bop);
                if (r)
                        break;
+                brb_pop(&smm->uncommitted);
        }
        return r;
@@ -683,7 +696,6 @@ static struct dm_space_map bootstrap_ops = {
 static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
 {
        int r, i;
-        enum allocation_event ev;
        struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
        dm_block_t old_len = smm->ll.nr_blocks;
@@ -705,11 +717,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
         * allocate any new blocks.
         */
        do {
-                for (i = old_len; !r && i < smm->begin; i++) {
+                for (i = old_len; !r && i < smm->begin; i++)
-                        r = sm_ll_inc(&smm->ll, i, &ev);
+                        r = add_bop(smm, BOP_INC, i);
-                        if (r)
-                                goto out;
+                if (r)
-                }
+                        goto out;
                old_len = smm->begin;
                r = apply_bops(smm);
@@ -754,7 +767,6 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
 {
        int r;
        dm_block_t i;
-        enum allocation_event ev;
        struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
        smm->begin = superblock + 1;
@@ -782,7 +794,7 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
         * allocated blocks that they were built from.
         */
        for (i = superblock; !r && i < smm->begin; i++)
-                r = sm_ll_inc(&smm->ll, i, &ev);
+                r = add_bop(smm, BOP_INC, i);
        if (r)
                return r;
diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
index d2e75c88f4d2..f40909793490 100644
--- a/drivers/misc/cxl/native.c
+++ b/drivers/misc/cxl/native.c
@@ -497,6 +497,7 @@ static u64 calculate_sr(struct cxl_context *ctx)
 {
        u64 sr = 0;
+        set_endian(sr);
        if (ctx->master)
                sr |= CXL_PSL_SR_An_MP;
        if (mfspr(SPRN_LPCR) & LPCR_TC)
@@ -506,7 +507,6 @@ static u64 calculate_sr(struct cxl_context *ctx)
                sr |= CXL_PSL_SR_An_HV;
        } else {
                sr |= CXL_PSL_SR_An_PR | CXL_PSL_SR_An_R;
-                set_endian(sr);
                sr &= ~(CXL_PSL_SR_An_HV);
                if (!test_tsk_thread_flag(current, TIF_32BIT))
                        sr |= CXL_PSL_SR_An_SF;
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index 2177e56ed0be..d48d5793407d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -1010,7 +1010,7 @@ static int mlx4_MAD_IFC_wrapper(struct mlx4_dev *dev, int slave,
                if (!(smp->mgmt_class == IB_MGMT_CLASS_SUBN_LID_ROUTED &&
                      smp->method == IB_MGMT_METHOD_GET) || network_view) {
                        mlx4_err(dev, "Unprivileged slave %d is trying to execute a Subnet MGMT MAD, class 0x%x, method 0x%x, view=%s for attr 0x%x. Rejecting\n",
-                                 slave, smp->method, smp->mgmt_class,
+                                 slave, smp->mgmt_class, smp->method,
                                 network_view ? "Network" : "Host",
                                 be16_to_cpu(smp->attr_id));
                        return -EPERM;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d8838dedb7a4..f94ab786088f 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -140,6 +140,12 @@ struct virtnet_info {
        /* CPU hot plug notifier */
        struct notifier_block nb;
+        /* Control VQ buffers: protected by the rtnl lock */
+        struct virtio_net_ctrl_hdr ctrl_hdr;
+        virtio_net_ctrl_ack ctrl_status;
+        u8 ctrl_promisc;
+        u8 ctrl_allmulti;
 };
 struct padded_vnet_hdr {
@@ -976,31 +982,30 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
                                 struct scatterlist *out)
 {
        struct scatterlist *sgs[4], hdr, stat;
-        struct virtio_net_ctrl_hdr ctrl;
-        virtio_net_ctrl_ack status = ~0;
        unsigned out_num = 0, tmp;
        /* Caller should know better */
        BUG_ON(!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ));
-        ctrl.class = class;
+        vi->ctrl_status = ~0;
-        ctrl.cmd = cmd;
+        vi->ctrl_hdr.class = class;
+        vi->ctrl_hdr.cmd = cmd;
        /* Add header */
-        sg_init_one(&hdr, &ctrl, sizeof(ctrl));
+        sg_init_one(&hdr, &vi->ctrl_hdr, sizeof(vi->ctrl_hdr));
        sgs[out_num++] = &hdr;
        if (out)
                sgs[out_num++] = out;
        /* Add return status. */
-        sg_init_one(&stat, &status, sizeof(status));
+        sg_init_one(&stat, &vi->ctrl_status, sizeof(vi->ctrl_status));
        sgs[out_num] = &stat;
        BUG_ON(out_num + 1 > ARRAY_SIZE(sgs));
        virtqueue_add_sgs(vi->cvq, sgs, out_num, 1, vi, GFP_ATOMIC);
        if (unlikely(!virtqueue_kick(vi->cvq)))
-                return status == VIRTIO_NET_OK;
+                return vi->ctrl_status == VIRTIO_NET_OK;
        /* Spin for a response, the kick causes an ioport write, trapping
         * into the hypervisor, so the request should be handled immediately.
@@ -1009,7 +1014,7 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
               !virtqueue_is_broken(vi->cvq))
                cpu_relax();
-        return status == VIRTIO_NET_OK;
+        return vi->ctrl_status == VIRTIO_NET_OK;
 }
 static int virtnet_set_mac_address(struct net_device *dev, void *p)
@@ -1151,7 +1156,6 @@ static void virtnet_set_rx_mode(struct net_device *dev)
 {
        struct virtnet_info *vi = netdev_priv(dev);
        struct scatterlist sg[2];
-        u8 promisc, allmulti;
        struct virtio_net_ctrl_mac *mac_data;
        struct netdev_hw_addr *ha;
        int uc_count;
@@ -1163,22 +1167,22 @@ static void virtnet_set_rx_mode(struct net_device *dev)
        if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_RX))
                return;
-        promisc = ((dev->flags & IFF_PROMISC) != 0);
+        vi->ctrl_promisc = ((dev->flags & IFF_PROMISC) != 0);
-        allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
+        vi->ctrl_allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
-        sg_init_one(sg, &promisc, sizeof(promisc));
+        sg_init_one(sg, &vi->ctrl_promisc, sizeof(vi->ctrl_promisc));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                  VIRTIO_NET_CTRL_RX_PROMISC, sg))
                dev_warn(&dev->dev, "Failed to %sable promisc mode.\n",
-                         promisc ? "en" : "dis");
+                         vi->ctrl_promisc ? "en" : "dis");
-        sg_init_one(sg, &allmulti, sizeof(allmulti));
+        sg_init_one(sg, &vi->ctrl_allmulti, sizeof(vi->ctrl_allmulti));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                  VIRTIO_NET_CTRL_RX_ALLMULTI, sg))
                dev_warn(&dev->dev, "Failed to %sable allmulti mode.\n",
-                         allmulti ? "en" : "dis");
+                         vi->ctrl_allmulti ? "en" : "dis");
        uc_count = netdev_uc_count(dev);
        mc_count = netdev_mc_count(dev);
diff --git a/drivers/nvdimm/core.c b/drivers/nvdimm/core.c
index 82c49bb87055..2e2832b83c93 100644
--- a/drivers/nvdimm/core.c
+++ b/drivers/nvdimm/core.c
@@ -11,6 +11,7 @@
 * General Public License for more details.
 */
 #include <linux/libnvdimm.h>
+#include <linux/badblocks.h>
 #include <linux/export.h>
 #include <linux/module.h>
 #include <linux/blkdev.h>
@@ -325,6 +326,7 @@ struct nvdimm_bus *__nvdimm_bus_register(struct device *parent,
        if (!nvdimm_bus)
                return NULL;
        INIT_LIST_HEAD(&nvdimm_bus->list);
+        INIT_LIST_HEAD(&nvdimm_bus->poison_list);
        init_waitqueue_head(&nvdimm_bus->probe_wait);
        nvdimm_bus->id = ida_simple_get(&nd_ida, 0, 0, GFP_KERNEL);
        mutex_init(&nvdimm_bus->reconfig_mutex);
@@ -359,6 +361,172 @@ struct nvdimm_bus *__nvdimm_bus_register(struct device *parent,
 }
 EXPORT_SYMBOL_GPL(__nvdimm_bus_register);
+static void set_badblock(struct badblocks *bb, sector_t s, int num)
+{
+        dev_dbg(bb->dev, "Found a poison range (0x%llx, 0x%llx)\n",
+                        (u64) s * 512, (u64) num * 512);
+        /* this isn't an error as the hardware will still throw an exception */
+        if (badblocks_set(bb, s, num, 1))
+                dev_info_once(bb->dev, "%s: failed for sector %llx\n",
+                                __func__, (u64) s);
+}
+/**
+ * __add_badblock_range() - Convert a physical address range to bad sectors
+ * @bb:         badblocks instance to populate
+ * @ns_offset:  namespace offset where the error range begins (in bytes)
+ * @len:        number of bytes of poison to be added
+ *
+ * This assumes that the range provided with (ns_offset, len) is within
+ * the bounds of physical addresses for this namespace, i.e. lies in the
+ * interval [ns_start, ns_start + ns_size)
+ */
+static void __add_badblock_range(struct badblocks *bb, u64 ns_offset, u64 len)
+{
+        const unsigned int sector_size = 512;
+        sector_t start_sector;
+        u64 num_sectors;
+        u32 rem;
+        start_sector = div_u64(ns_offset, sector_size);
+        num_sectors = div_u64_rem(len, sector_size, &rem);
+        if (rem)
+                num_sectors++;
+        if (unlikely(num_sectors > (u64)INT_MAX)) {
+                u64 remaining = num_sectors;
+                sector_t s = start_sector;
+                while (remaining) {
+                        int done = min_t(u64, remaining, INT_MAX);
+                        set_badblock(bb, s, done);
+                        remaining -= done;
+                        s += done;
+                }
+        } else
+                set_badblock(bb, start_sector, num_sectors);
+}
+/**
+ * nvdimm_namespace_add_poison() - Convert a list of poison ranges to badblocks
+ * @ndns:       the namespace containing poison ranges
+ * @bb:         badblocks instance to populate
+ * @offset:     offset at the start of the namespace before 'sector 0'
+ *
+ * The poison list generated during NFIT initialization may contain multiple,
+ * possibly overlapping ranges in the SPA (System Physical Address) space.
+ * Compare each of these ranges to the namespace currently being initialized,
+ * and add badblocks to the gendisk for all matching sub-ranges
+ */
+void nvdimm_namespace_add_poison(struct nd_namespace_common *ndns,
+                struct badblocks *bb, resource_size_t offset)
+{
+        struct nd_namespace_io *nsio = to_nd_namespace_io(&ndns->dev);
+        struct nd_region *nd_region = to_nd_region(ndns->dev.parent);
+        struct nvdimm_bus *nvdimm_bus;
+        struct list_head *poison_list;
+        u64 ns_start, ns_end, ns_size;
+        struct nd_poison *pl;
+        ns_size = nvdimm_namespace_capacity(ndns) - offset;
+        ns_start = nsio->res.start + offset;
+        ns_end = nsio->res.end;
+        nvdimm_bus = to_nvdimm_bus(nd_region->dev.parent);
+        poison_list = &nvdimm_bus->poison_list;
+        if (list_empty(poison_list))
+                return;
+        list_for_each_entry(pl, poison_list, list) {
+                u64 pl_end = pl->start + pl->length - 1;
+                /* Discard intervals with no intersection */
+                if (pl_end < ns_start)
+                        continue;
+                if (pl->start > ns_end)
+                        continue;
+                /* Deal with any overlap after start of the namespace */
+                if (pl->start >= ns_start) {
+                        u64 start = pl->start;
+                        u64 len;
+                        if (pl_end <= ns_end)
+                                len = pl->length;
+                        else
+                                len = ns_start + ns_size - pl->start;
+                        __add_badblock_range(bb, start - ns_start, len);
+                        continue;
+                }
+                /* Deal with overlap for poison starting before the namespace */
+                if (pl->start < ns_start) {
+                        u64 len;
+                        if (pl_end < ns_end)
+                                len = pl->start + pl->length - ns_start;
+                        else
+                                len = ns_size;
+                        __add_badblock_range(bb, 0, len);
+                }
+        }
+}
+EXPORT_SYMBOL_GPL(nvdimm_namespace_add_poison);
+static int __add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length)
+{
+        struct nd_poison *pl;
+        pl = kzalloc(sizeof(*pl), GFP_KERNEL);
+        if (!pl)
+                return -ENOMEM;
+        pl->start = addr;
+        pl->length = length;
+        list_add_tail(&pl->list, &nvdimm_bus->poison_list);
+        return 0;
+}
+int nvdimm_bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length)
+{
+        struct nd_poison *pl;
+        if (list_empty(&nvdimm_bus->poison_list))
+                return __add_poison(nvdimm_bus, addr, length);
+        /*
+         * There is a chance this is a duplicate, check for those first.
+         * This will be the common case as ARS_STATUS returns all known
+         * errors in the SPA space, and we can't query it per region
+         */
+        list_for_each_entry(pl, &nvdimm_bus->poison_list, list)
+                if (pl->start == addr) {
+                        /* If length has changed, update this list entry */
+                        if (pl->length != length)
+                                pl->length = length;
+                        return 0;
+                }
+        /*
+         * If not a duplicate or a simple length update, add the entry as is,
+         * as any overlapping ranges will get resolved when the list is consumed
+         * and converted to badblocks
+         */
+        return __add_poison(nvdimm_bus, addr, length);
+}
+EXPORT_SYMBOL_GPL(nvdimm_bus_add_poison);
+static void free_poison_list(struct list_head *poison_list)
+{
+        struct nd_poison *pl, *next;
+        list_for_each_entry_safe(pl, next, poison_list, list) {
+                list_del(&pl->list);
+                kfree(pl);
+        }
+        list_del_init(poison_list);
+}
 static int child_unregister(struct device *dev, void *data)
 {
        /*
@@ -385,6 +553,7 @@ void nvdimm_bus_unregister(struct nvdimm_bus *nvdimm_bus)
        nd_synchronize();
        device_for_each_child(&nvdimm_bus->dev, NULL, child_unregister);
+        free_poison_list(&nvdimm_bus->poison_list);
        nvdimm_bus_destroy_ndctl(nvdimm_bus);
        device_unregister(&nvdimm_bus->dev);
diff --git a/drivers/nvdimm/nd-core.h b/drivers/nvdimm/nd-core.h
index 3249c498892a..1d1500f3d8b5 100644
--- a/drivers/nvdimm/nd-core.h
+++ b/drivers/nvdimm/nd-core.h
@@ -30,6 +30,7 @@ struct nvdimm_bus {
        struct list_head list;
        struct device dev;
        int id, probe_active;
+        struct list_head poison_list;
        struct mutex reconfig_mutex;
 };
diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
index e4e9f9ae0cc8..ba1633b9da31 100644
--- a/drivers/nvdimm/nd.h
+++ b/drivers/nvdimm/nd.h
@@ -31,6 +31,12 @@ enum {
        INT_LBASIZE_ALIGNMENT = 64,
 };
+struct nd_poison {
+        u64 start;
+        u64 length;
+        struct list_head list;
+};
 struct nvdimm_drvdata {
        struct device *dev;
        int nsindex_size;
@@ -256,6 +262,8 @@ int nvdimm_namespace_attach_btt(struct nd_namespace_common *ndns);
 int nvdimm_namespace_detach_btt(struct nd_namespace_common *ndns);
 const char *nvdimm_namespace_disk_name(struct nd_namespace_common *ndns,
                char *name);
+void nvdimm_namespace_add_poison(struct nd_namespace_common *ndns,
+                struct badblocks *bb, resource_size_t offset);
 int nd_blk_region_init(struct nd_region *nd_region);
 void __nd_iostat_start(struct bio *bio, unsigned long *start);
 static inline bool nd_iostat_start(struct bio *bio, unsigned long *start)
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index ab689bca727d..b493ff3fccb2 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -23,6 +23,7 @@
 #include <linux/module.h>
 #include <linux/memory_hotplug.h>
 #include <linux/moduleparam.h>
+#include <linux/badblocks.h>
 #include <linux/vmalloc.h>
 #include <linux/slab.h>
 #include <linux/pmem.h>
@@ -41,11 +42,25 @@ struct pmem_device {
        phys_addr_t             data_offset;
        void __pmem             *virt_addr;
        size_t                  size;
+        struct badblocks        bb;
 };
 static int pmem_major;
-static void pmem_do_bvec(struct pmem_device *pmem, struct page *page,
+static bool is_bad_pmem(struct badblocks *bb, sector_t sector, unsigned int len)
+{
+        if (bb->count) {
+                sector_t first_bad;
+                int num_bad;
+                return !!badblocks_check(bb, sector, len / 512, &first_bad,
+                                &num_bad);
+        }
+        return false;
+}
+static int pmem_do_bvec(struct pmem_device *pmem, struct page *page,
                        unsigned int len, unsigned int off, int rw,
                        sector_t sector)
 {
@@ -54,6 +69,8 @@ static void pmem_do_bvec(struct pmem_device *pmem, struct page *page,
        void __pmem *pmem_addr = pmem->virt_addr + pmem_off;
        if (rw == READ) {
+                if (unlikely(is_bad_pmem(&pmem->bb, sector, len)))
+                        return -EIO;
                memcpy_from_pmem(mem + off, pmem_addr, len);
                flush_dcache_page(page);
        } else {
@@ -62,10 +79,12 @@ static void pmem_do_bvec(struct pmem_device *pmem, struct page *page,
        }
        kunmap_atomic(mem);
+        return 0;
 }
 static blk_qc_t pmem_make_request(struct request_queue *q, struct bio *bio)
 {
+        int rc = 0;
        bool do_acct;
        unsigned long start;
        struct bio_vec bvec;
@@ -74,9 +93,15 @@ static blk_qc_t pmem_make_request(struct request_queue *q, struct bio *bio)
        struct pmem_device *pmem = bdev->bd_disk->private_data;
        do_acct = nd_iostat_start(bio, &start);
-        bio_for_each_segment(bvec, bio, iter)
+        bio_for_each_segment(bvec, bio, iter) {
-                pmem_do_bvec(pmem, bvec.bv_page, bvec.bv_len, bvec.bv_offset,
+                rc = pmem_do_bvec(pmem, bvec.bv_page, bvec.bv_len,
-                                bio_data_dir(bio), iter.bi_sector);
+                                bvec.bv_offset, bio_data_dir(bio),
+                                iter.bi_sector);
+                if (rc) {
+                        bio->bi_error = rc;
+                        break;
+                }
+        }
        if (do_acct)
                nd_iostat_end(bio, start);
@@ -91,13 +116,22 @@ static int pmem_rw_page(struct block_device *bdev, sector_t sector,
                       struct page *page, int rw)
 {
        struct pmem_device *pmem = bdev->bd_disk->private_data;
+        int rc;
-        pmem_do_bvec(pmem, page, PAGE_CACHE_SIZE, 0, rw, sector);
+        rc = pmem_do_bvec(pmem, page, PAGE_CACHE_SIZE, 0, rw, sector);
        if (rw & WRITE)
                wmb_pmem();
-        page_endio(page, rw & WRITE, 0);
-        return 0;
+        /*
+         * The ->rw_page interface is subtle and tricky.  The core
+         * retries on any error, so we can only invoke page_endio() in
+         * the successful completion case.  Otherwise, we'll see crashes
+         * caused by double completion.
+         */
+        if (rc == 0)
+                page_endio(page, rw & WRITE, 0);
+        return rc;
 }
 static long pmem_direct_access(struct block_device *bdev, sector_t sector,
@@ -195,7 +229,12 @@ static int pmem_attach_disk(struct device *dev,
        disk->driverfs_dev = dev;
        set_capacity(disk, (pmem->size - pmem->data_offset) / 512);
        pmem->pmem_disk = disk;
+        devm_exit_badblocks(dev, &pmem->bb);
+        if (devm_init_badblocks(dev, &pmem->bb))
+                return -ENOMEM;
+        nvdimm_namespace_add_poison(ndns, &pmem->bb, pmem->data_offset);
+        disk->bb = &pmem->bb;
        add_disk(disk);
        revalidate_disk(disk);
@@ -212,9 +251,13 @@ static int pmem_rw_bytes(struct nd_namespace_common *ndns,
                return -EFAULT;
        }
-        if (rw == READ)
+        if (rw == READ) {
+                unsigned int sz_align = ALIGN(size + (offset & (512 - 1)), 512);
+                if (unlikely(is_bad_pmem(&pmem->bb, offset / 512, sz_align)))
+                        return -EIO;
                memcpy_from_pmem(buf, pmem->virt_addr + offset, size);
-        else {
+        } else {
                memcpy_to_pmem(pmem->virt_addr + offset, buf, size);
                wmb_pmem();
        }
@@ -377,6 +420,9 @@ static int nd_pmem_probe(struct device *dev)
        pmem->ndns = ndns;
        dev_set_drvdata(dev, pmem);
        ndns->rw_bytes = pmem_rw_bytes;
+        if (devm_init_badblocks(dev, &pmem->bb))
+                return -ENOMEM;
+        nvdimm_namespace_add_poison(ndns, &pmem->bb, 0);
        if (is_nd_btt(dev))
                return nvdimm_namespace_attach_btt(ndns);
diff --git a/drivers/nvme/host/lightnvm.c b/drivers/nvme/host/lightnvm.c
index 06c336410235..15f2acb4d5cd 100644
--- a/drivers/nvme/host/lightnvm.c
+++ b/drivers/nvme/host/lightnvm.c
@@ -271,9 +271,9 @@ static int init_grps(struct nvm_id *nvm_id, struct nvme_nvm_id *nvme_nvm_id)
        return 0;
 }
-static int nvme_nvm_identity(struct request_queue *q, struct nvm_id *nvm_id)
+static int nvme_nvm_identity(struct nvm_dev *nvmdev, struct nvm_id *nvm_id)
 {
-        struct nvme_ns *ns = q->queuedata;
+        struct nvme_ns *ns = nvmdev->q->queuedata;
        struct nvme_dev *dev = ns->dev;
        struct nvme_nvm_id *nvme_nvm_id;
        struct nvme_nvm_command c = {};
@@ -308,10 +308,10 @@ out:
        return ret;
 }
-static int nvme_nvm_get_l2p_tbl(struct request_queue *q, u64 slba, u32 nlb,
+static int nvme_nvm_get_l2p_tbl(struct nvm_dev *nvmdev, u64 slba, u32 nlb,
                                nvm_l2p_update_fn *update_l2p, void *priv)
 {
-        struct nvme_ns *ns = q->queuedata;
+        struct nvme_ns *ns = nvmdev->q->queuedata;
        struct nvme_dev *dev = ns->dev;
        struct nvme_nvm_command c = {};
        u32 len = queue_max_hw_sectors(dev->admin_q) << 9;
@@ -415,10 +415,10 @@ out:
        return ret;
 }
-static int nvme_nvm_set_bb_tbl(struct request_queue *q, struct nvm_rq *rqd,
+static int nvme_nvm_set_bb_tbl(struct nvm_dev *nvmdev, struct nvm_rq *rqd,
                                                                int type)
 {
-        struct nvme_ns *ns = q->queuedata;
+        struct nvme_ns *ns = nvmdev->q->queuedata;
        struct nvme_dev *dev = ns->dev;
        struct nvme_nvm_command c = {};
        int ret = 0;
@@ -455,7 +455,7 @@ static void nvme_nvm_end_io(struct request *rq, int error)
        struct nvm_rq *rqd = rq->end_io_data;
        struct nvm_dev *dev = rqd->dev;
-        if (dev->mt->end_io(rqd, error))
+        if (dev->mt && dev->mt->end_io(rqd, error))
                pr_err("nvme: err status: %x result: %lx\n",
                                rq->errors, (unsigned long)rq->special);
@@ -463,8 +463,9 @@ static void nvme_nvm_end_io(struct request *rq, int error)
        blk_mq_free_request(rq);
 }
-static int nvme_nvm_submit_io(struct request_queue *q, struct nvm_rq *rqd)
+static int nvme_nvm_submit_io(struct nvm_dev *dev, struct nvm_rq *rqd)
 {
+        struct request_queue *q = dev->q;
        struct nvme_ns *ns = q->queuedata;
        struct request *rq;
        struct bio *bio = rqd->bio;
@@ -502,8 +503,9 @@ static int nvme_nvm_submit_io(struct request_queue *q, struct nvm_rq *rqd)
        return 0;
 }
-static int nvme_nvm_erase_block(struct request_queue *q, struct nvm_rq *rqd)
+static int nvme_nvm_erase_block(struct nvm_dev *dev, struct nvm_rq *rqd)
 {
+        struct request_queue *q = dev->q;
        struct nvme_ns *ns = q->queuedata;
        struct nvme_nvm_command c = {};
@@ -515,9 +517,9 @@ static int nvme_nvm_erase_block(struct request_queue *q, struct nvm_rq *rqd)
        return nvme_submit_sync_cmd(q, (struct nvme_command *)&c, NULL, 0);
 }
-static void *nvme_nvm_create_dma_pool(struct request_queue *q, char *name)
+static void *nvme_nvm_create_dma_pool(struct nvm_dev *nvmdev, char *name)
 {
-        struct nvme_ns *ns = q->queuedata;
+        struct nvme_ns *ns = nvmdev->q->queuedata;
        struct nvme_dev *dev = ns->dev;
        return dma_pool_create(name, dev->dev, PAGE_SIZE, PAGE_SIZE, 0);
@@ -530,7 +532,7 @@ static void nvme_nvm_destroy_dma_pool(void *pool)
        dma_pool_destroy(dma_pool);
 }
-static void *nvme_nvm_dev_dma_alloc(struct request_queue *q, void *pool,
+static void *nvme_nvm_dev_dma_alloc(struct nvm_dev *dev, void *pool,
                                    gfp_t mem_flags, dma_addr_t *dma_handler)
 {
        return dma_pool_alloc(pool, mem_flags, dma_handler);
diff --git a/drivers/of/address.c b/drivers/of/address.c
index cd53fe4a0c86..9582c5703b3c 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -485,9 +485,10 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus,
        int rone;
        u64 offset = OF_BAD_ADDR;
-        /* Normally, an absence of a "ranges" property means we are
+        /*
+         * Normally, an absence of a "ranges" property means we are
         * crossing a non-translatable boundary, and thus the addresses
-         * below the current not cannot be converted to CPU physical ones.
+         * below the current cannot be converted to CPU physical ones.
         * Unfortunately, while this is very clear in the spec, it's not
         * what Apple understood, and they do have things like /uni-n or
         * /ht nodes with no "ranges" property and a lot of perfectly
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index d2430298a309..655f79db7899 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/initrd.h>
 #include <linux/memblock.h>
+#include <linux/mutex.h>
 #include <linux/of.h>
 #include <linux/of_fdt.h>
 #include <linux/of_reserved_mem.h>
@@ -436,6 +437,8 @@ static void *kernel_tree_alloc(u64 size, u64 align)
        return kzalloc(size, GFP_KERNEL);
 }
+static DEFINE_MUTEX(of_fdt_unflatten_mutex);
 /**
 * of_fdt_unflatten_tree - create tree of device_nodes from flat blob
 *
@@ -447,7 +450,9 @@ static void *kernel_tree_alloc(u64 size, u64 align)
 void of_fdt_unflatten_tree(const unsigned long *blob,
                        struct device_node **mynodes)
 {
+        mutex_lock(&of_fdt_unflatten_mutex);
        __unflatten_device_tree(blob, mynodes, &kernel_tree_alloc);
+        mutex_unlock(&of_fdt_unflatten_mutex);
 }
 EXPORT_SYMBOL_GPL(of_fdt_unflatten_tree);
@@ -1041,7 +1046,7 @@ void __init __weak early_init_dt_add_memory_arch(u64 base, u64 size)
 int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base,
                                        phys_addr_t size, bool nomap)
 {
-        pr_err("Reserved memory not supported, ignoring range 0x%pa - 0x%pa%s\n",
+        pr_err("Reserved memory not supported, ignoring range %pa - %pa%s\n",
                  &base, &size, nomap ? " (nomap)" : "");
        return -ENOSYS;
 }
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 902b89be7217..4fa916dffc91 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -53,7 +53,7 @@ EXPORT_SYMBOL_GPL(irq_of_parse_and_map);
 * Returns a pointer to the interrupt parent node, or NULL if the interrupt
 * parent could not be determined.
 */
-static struct device_node *of_irq_find_parent(struct device_node *child)
+struct device_node *of_irq_find_parent(struct device_node *child)
 {
        struct device_node *p;
        const __be32 *parp;
@@ -77,6 +77,7 @@ static struct device_node *of_irq_find_parent(struct device_node *child)
        return p;
 }
+EXPORT_SYMBOL_GPL(of_irq_find_parent);
 /**
 * of_irq_parse_raw - Low level interrupt tree parsing
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index be77e75c587d..1a3556a9e9ea 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -206,7 +206,13 @@ static int __init __rmem_cmp(const void *a, const void *b)
 {
        const struct reserved_mem *ra = a, *rb = b;
-        return ra->base - rb->base;
+        if (ra->base < rb->base)
+                return -1;
+        if (ra->base > rb->base)
+                return 1;
+        return 0;
 }
 static void __init __rmem_check_for_overlap(void)
diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h
index 761e77bfce5d..e56f1569f6c3 100644
--- a/drivers/parisc/iommu-helpers.h
+++ b/drivers/parisc/iommu-helpers.h
@@ -104,7 +104,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev,
        struct scatterlist *contig_sg;     /* contig chunk head */
        unsigned long dma_offset, dma_len; /* start/len of DMA stream */
        unsigned int n_mappings = 0;
-        unsigned int max_seg_size = dma_get_max_seg_size(dev);
+        unsigned int max_seg_size = min(dma_get_max_seg_size(dev),
+                                        (unsigned)DMA_CHUNK_SIZE);
+        unsigned int max_seg_boundary = dma_get_seg_boundary(dev) + 1;
+        if (max_seg_boundary)   /* check if the addition above didn't overflow */
+                max_seg_size = min(max_seg_size, max_seg_boundary);
        while (nents > 0) {
@@ -138,14 +142,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev,
                        /*
                        ** First make sure current dma stream won't
-                        ** exceed DMA_CHUNK_SIZE if we coalesce the
+                        ** exceed max_seg_size if we coalesce the
                        ** next entry.
                        */   
-                        if(unlikely(ALIGN(dma_len + dma_offset + startsg->length,
+                        if (unlikely(ALIGN(dma_len + dma_offset + startsg->length, IOVP_SIZE) >
-                                            IOVP_SIZE) > DMA_CHUNK_SIZE))
+                                     max_seg_size))
-                                break;
-                        if (startsg->length + dma_len > max_seg_size)
                                break;
                        /*
diff --git a/drivers/pci/host/pcie-altera.c b/drivers/pci/host/pcie-altera.c
index e5dda38bdde5..99da549d5d06 100644
--- a/drivers/pci/host/pcie-altera.c
+++ b/drivers/pci/host/pcie-altera.c
@@ -55,8 +55,10 @@
 #define TLP_CFG_DW2(bus, devfn, offset) \
                                (((bus) << 24) | ((devfn) << 16) | (offset))
 #define TLP_REQ_ID(bus, devfn)          (((bus) << 8) | (devfn))
+#define TLP_COMP_STATUS(s)              (((s) >> 12) & 7)
 #define TLP_HDR_SIZE                    3
 #define TLP_LOOP                        500
+#define RP_DEVFN                        0
 #define INTX_NUM                        4
@@ -166,34 +168,41 @@ static bool altera_pcie_valid_config(struct altera_pcie *pcie,
 static int tlp_read_packet(struct altera_pcie *pcie, u32 *value)
 {
-        u8 loop;
+        int i;
        bool sop = 0;
        u32 ctrl;
        u32 reg0, reg1;
+        u32 comp_status = 1;
        /*
         * Minimum 2 loops to read TLP headers and 1 loop to read data
         * payload.
         */
-        for (loop = 0; loop < TLP_LOOP; loop++) {
+        for (i = 0; i < TLP_LOOP; i++) {
                ctrl = cra_readl(pcie, RP_RXCPL_STATUS);
                if ((ctrl & RP_RXCPL_SOP) || (ctrl & RP_RXCPL_EOP) || sop) {
                        reg0 = cra_readl(pcie, RP_RXCPL_REG0);
                        reg1 = cra_readl(pcie, RP_RXCPL_REG1);
-                        if (ctrl & RP_RXCPL_SOP)
+                        if (ctrl & RP_RXCPL_SOP) {
                                sop = true;
+                                comp_status = TLP_COMP_STATUS(reg1);
+                        }
                        if (ctrl & RP_RXCPL_EOP) {
+                                if (comp_status)
+                                        return PCIBIOS_DEVICE_NOT_FOUND;
                                if (value)
                                        *value = reg0;
                                return PCIBIOS_SUCCESSFUL;
                        }
                }
                udelay(5);
        }
-        return -ENOENT;
+        return PCIBIOS_DEVICE_NOT_FOUND;
 }
 static void tlp_write_packet(struct altera_pcie *pcie, u32 *headers,
@@ -233,7 +242,7 @@ static int tlp_cfg_dword_read(struct altera_pcie *pcie, u8 bus, u32 devfn,
        else
                headers[0] = TLP_CFG_DW0(TLP_FMTTYPE_CFGRD1);
-        headers[1] = TLP_CFG_DW1(TLP_REQ_ID(pcie->root_bus_nr, devfn),
+        headers[1] = TLP_CFG_DW1(TLP_REQ_ID(pcie->root_bus_nr, RP_DEVFN),
                                        TLP_READ_TAG, byte_en);
        headers[2] = TLP_CFG_DW2(bus, devfn, where);
@@ -253,7 +262,7 @@ static int tlp_cfg_dword_write(struct altera_pcie *pcie, u8 bus, u32 devfn,
        else
                headers[0] = TLP_CFG_DW0(TLP_FMTTYPE_CFGWR1);
-        headers[1] = TLP_CFG_DW1(TLP_REQ_ID(pcie->root_bus_nr, devfn),
+        headers[1] = TLP_CFG_DW1(TLP_REQ_ID(pcie->root_bus_nr, RP_DEVFN),
                                        TLP_WRITE_TAG, byte_en);
        headers[2] = TLP_CFG_DW2(bus, devfn, where);
@@ -458,7 +467,7 @@ static int altera_pcie_init_irq_domain(struct altera_pcie *pcie)
        struct device_node *node = dev->of_node;
        /* Setup INTx */
-        pcie->irq_domain = irq_domain_add_linear(node, INTX_NUM,
+        pcie->irq_domain = irq_domain_add_linear(node, INTX_NUM + 1,
                                        &intx_domain_ops, pcie);
        if (!pcie->irq_domain) {
                dev_err(dev, "Failed to get a INTx IRQ domain\n");
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 53e463244bb7..7eaa4c87fec7 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -54,7 +54,7 @@ static int pci_msi_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
        struct irq_domain *domain;
        domain = pci_msi_get_domain(dev);
-        if (domain)
+        if (domain && irq_domain_is_hierarchy(domain))
                return pci_msi_domain_alloc_irqs(domain, dev, nvec, type);
        return arch_setup_msi_irqs(dev, nvec, type);
@@ -65,7 +65,7 @@ static void pci_msi_teardown_msi_irqs(struct pci_dev *dev)
        struct irq_domain *domain;
        domain = pci_msi_get_domain(dev);
-        if (domain)
+        if (domain && irq_domain_is_hierarchy(domain))
                pci_msi_domain_free_irqs(domain, dev);
        else
                arch_teardown_msi_irqs(dev);
diff --git a/drivers/staging/iio/iio_simple_dummy_events.c b/drivers/staging/iio/iio_simple_dummy_events.c
index bfbf1c56bd22..6eb600ff7056 100644
--- a/drivers/staging/iio/iio_simple_dummy_events.c
+++ b/drivers/staging/iio/iio_simple_dummy_events.c
@@ -159,7 +159,7 @@ static irqreturn_t iio_simple_dummy_get_timestamp(int irq, void *private)
        struct iio_dummy_state *st = iio_priv(indio_dev);
        st->event_timestamp = iio_get_time_ns();
-        return IRQ_HANDLED;
+        return IRQ_WAKE_THREAD;
 }
 /**
diff --git a/drivers/staging/lustre/lustre/obdecho/echo_client.c b/drivers/staging/lustre/lustre/obdecho/echo_client.c
index f61ef669644c..a4a9a763ff02 100644
--- a/drivers/staging/lustre/lustre/obdecho/echo_client.c
+++ b/drivers/staging/lustre/lustre/obdecho/echo_client.c
@@ -1270,6 +1270,7 @@ static int
 echo_copyout_lsm(struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
 {
        struct lov_stripe_md *ulsm = _ulsm;
+        struct lov_oinfo **p;
        int nob, i;
        nob = offsetof(struct lov_stripe_md, lsm_oinfo[lsm->lsm_stripe_count]);
@@ -1279,9 +1280,10 @@ echo_copyout_lsm(struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
        if (copy_to_user(ulsm, lsm, sizeof(*ulsm)))
                return -EFAULT;
-        for (i = 0; i < lsm->lsm_stripe_count; i++) {
+        for (i = 0, p = lsm->lsm_oinfo; i < lsm->lsm_stripe_count; i++, p++) {
-                if (copy_to_user(ulsm->lsm_oinfo[i], lsm->lsm_oinfo[i],
+                struct lov_oinfo __user *up;
-                                      sizeof(lsm->lsm_oinfo[0])))
+                if (get_user(up, ulsm->lsm_oinfo + i) ||
+                    copy_to_user(up, *p, sizeof(struct lov_oinfo)))
                        return -EFAULT;
        }
        return 0;
@@ -1289,9 +1291,10 @@ echo_copyout_lsm(struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
 static int
 echo_copyin_lsm(struct echo_device *ed, struct lov_stripe_md *lsm,
-                 void *ulsm, int ulsm_nob)
+                struct lov_stripe_md __user *ulsm, int ulsm_nob)
 {
        struct echo_client_obd *ec = ed->ed_ec;
+        struct lov_oinfo **p;
        int                  i;
        if (ulsm_nob < sizeof(*lsm))
@@ -1306,11 +1309,10 @@ echo_copyin_lsm(struct echo_device *ed, struct lov_stripe_md *lsm,
            ((__u64)lsm->lsm_stripe_size * lsm->lsm_stripe_count > ~0UL))
                return -EINVAL;
-        for (i = 0; i < lsm->lsm_stripe_count; i++) {
+        for (i = 0, p = lsm->lsm_oinfo; i < lsm->lsm_stripe_count; i++, p++) {
-                if (copy_from_user(lsm->lsm_oinfo[i],
+                struct lov_oinfo __user *up;
-                                       ((struct lov_stripe_md *)ulsm)-> \
+                if (get_user(up, ulsm->lsm_oinfo + i) ||
-                                       lsm_oinfo[i],
+                    copy_from_user(*p, up, sizeof(struct lov_oinfo)))
-                                       sizeof(lsm->lsm_oinfo[0])))
                        return -EFAULT;
        }
        return 0;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index b30e7423549b..26ca4f910cb0 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1838,6 +1838,11 @@ static const struct usb_device_id acm_ids[] = {
        },
 #endif
+        /* Exclude Infineon Flash Loader utility */
+        { USB_DEVICE(0x058b, 0x0041),
+        .driver_info = IGNORE_DEVICE,
+        },
        /* control interfaces without any protocol set */
        { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
                USB_CDC_PROTO_NONE) },
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 7caff020106e..5050760f5e17 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -115,7 +115,8 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
                   USB_SS_MULT(desc->bmAttributes) > 3) {
                dev_warn(ddev, "Isoc endpoint has Mult of %d in "
                                "config %d interface %d altsetting %d ep %d: "
-                                "setting to 3\n", desc->bmAttributes + 1,
+                                "setting to 3\n",
+                                USB_SS_MULT(desc->bmAttributes),
                                cfgno, inum, asnum, ep->desc.bEndpointAddress);
                ep->ss_ep_comp.bmAttributes = 2;
        }
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index bdeadc112d29..a5cc032ef77a 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -124,6 +124,10 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
 int usb_device_supports_lpm(struct usb_device *udev)
 {
+        /* Some devices have trouble with LPM */
+        if (udev->quirks & USB_QUIRK_NO_LPM)
+                return 0;
        /* USB 2.1 (and greater) devices indicate LPM support through
         * their USB 2.0 Extended Capabilities BOS descriptor.
         */
@@ -4512,6 +4516,8 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1,
                goto fail;
        }
+        usb_detect_quirks(udev);
        if (udev->wusb == 0 && le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0201) {
                retval = usb_get_bos_descriptor(udev);
                if (!retval) {
@@ -4710,7 +4716,6 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                if (status < 0)
                        goto loop;
-                usb_detect_quirks(udev);
                if (udev->quirks & USB_QUIRK_DELAY_INIT)
                        msleep(1000);
@@ -5326,9 +5331,6 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
        if (udev->usb2_hw_lpm_enabled == 1)
                usb_set_usb2_hardware_lpm(udev, 0);
-        bos = udev->bos;
-        udev->bos = NULL;
        /* Disable LPM and LTM while we reset the device and reinstall the alt
         * settings.  Device-initiated LPM settings, and system exit latency
         * settings are cleared when the device is reset, so we have to set
@@ -5337,15 +5339,18 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
        ret = usb_unlocked_disable_lpm(udev);
        if (ret) {
                dev_err(&udev->dev, "%s Failed to disable LPM\n.", __func__);
-                goto re_enumerate;
+                goto re_enumerate_no_bos;
        }
        ret = usb_disable_ltm(udev);
        if (ret) {
                dev_err(&udev->dev, "%s Failed to disable LTM\n.",
                                __func__);
-                goto re_enumerate;
+                goto re_enumerate_no_bos;
        }
+        bos = udev->bos;
+        udev->bos = NULL;
        for (i = 0; i < SET_CONFIG_TRIES; ++i) {
                /* ep0 maxpacket size may change; let the HCD know about it.
@@ -5442,10 +5447,11 @@ done:
        return 0;
 re_enumerate:
-        /* LPM state doesn't matter when we're about to destroy the device. */
-        hub_port_logical_disconnect(parent_hub, port1);
        usb_release_bos_descriptor(udev);
        udev->bos = bos;
+re_enumerate_no_bos:
+        /* LPM state doesn't matter when we're about to destroy the device. */
+        hub_port_logical_disconnect(parent_hub, port1);
        return -ENODEV;
 }
diff --git a/drivers/usb/core/port.c b/drivers/usb/core/port.c
index 210618319f10..5487fe308f01 100644
--- a/drivers/usb/core/port.c
+++ b/drivers/usb/core/port.c
@@ -206,7 +206,7 @@ static int link_peers(struct usb_port *left, struct usb_port *right)
                else
                        method = "default";
-                pr_warn("usb: failed to peer %s and %s by %s (%s:%s) (%s:%s)\n",
+                pr_debug("usb: failed to peer %s and %s by %s (%s:%s) (%s:%s)\n",
                        dev_name(&left->dev), dev_name(&right->dev), method,
                        dev_name(&left->dev),
                        lpeer ? dev_name(&lpeer->dev) : "none",
@@ -265,7 +265,7 @@ static void link_peers_report(struct usb_port *left, struct usb_port *right)
        if (rc == 0) {
                dev_dbg(&left->dev, "peered to %s\n", dev_name(&right->dev));
        } else {
-                dev_warn(&left->dev, "failed to peer to %s (%d)\n",
+                dev_dbg(&left->dev, "failed to peer to %s (%d)\n",
                                dev_name(&right->dev), rc);
                pr_warn_once("usb: port power management may be unreliable\n");
                usb_port_block_power_off = 1;
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index f5a381945db2..6dc810bce295 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -125,6 +125,9 @@ static const struct usb_device_id usb_quirk_list[] = {
        { USB_DEVICE(0x04f3, 0x016f), .driver_info =
                        USB_QUIRK_DEVICE_QUALIFIER },
+        { USB_DEVICE(0x04f3, 0x21b8), .driver_info =
+                        USB_QUIRK_DEVICE_QUALIFIER },
        /* Roland SC-8820 */
        { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },
@@ -199,6 +202,12 @@ static const struct usb_device_id usb_quirk_list[] = {
        { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
                        USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+        /* Blackmagic Design Intensity Shuttle */
+        { USB_DEVICE(0x1edb, 0xbd3b), .driver_info = USB_QUIRK_NO_LPM },
+        /* Blackmagic Design UltraStudio SDI */
+        { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM },
        { }  /* terminating entry must be last */
 };
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index e61d773cf65e..39c1cbf0e75d 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -125,9 +125,11 @@ static int __dwc2_lowlevel_hw_enable(struct dwc2_hsotg *hsotg)
        if (ret)
                return ret;
-        ret = clk_prepare_enable(hsotg->clk);
+        if (hsotg->clk) {
-        if (ret)
+                ret = clk_prepare_enable(hsotg->clk);
-                return ret;
+                if (ret)
+                        return ret;
+        }
        if (hsotg->uphy)
                ret = usb_phy_init(hsotg->uphy);
@@ -175,7 +177,8 @@ static int __dwc2_lowlevel_hw_disable(struct dwc2_hsotg *hsotg)
        if (ret)
                return ret;
-        clk_disable_unprepare(hsotg->clk);
+        if (hsotg->clk)
+                clk_disable_unprepare(hsotg->clk);
        ret = regulator_bulk_disable(ARRAY_SIZE(hsotg->supplies),
                                     hsotg->supplies);
@@ -212,14 +215,41 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
         */
        hsotg->phy = devm_phy_get(hsotg->dev, "usb2-phy");
        if (IS_ERR(hsotg->phy)) {
-                hsotg->phy = NULL;
+                ret = PTR_ERR(hsotg->phy);
+                switch (ret) {
+                case -ENODEV:
+                case -ENOSYS:
+                        hsotg->phy = NULL;
+                        break;
+                case -EPROBE_DEFER:
+                        return ret;
+                default:
+                        dev_err(hsotg->dev, "error getting phy %d\n", ret);
+                        return ret;
+                }
+        }
+        if (!hsotg->phy) {
                hsotg->uphy = devm_usb_get_phy(hsotg->dev, USB_PHY_TYPE_USB2);
-                if (IS_ERR(hsotg->uphy))
+                if (IS_ERR(hsotg->uphy)) {
-                        hsotg->uphy = NULL;
+                        ret = PTR_ERR(hsotg->uphy);
-                else
+                        switch (ret) {
-                        hsotg->plat = dev_get_platdata(hsotg->dev);
+                        case -ENODEV:
+                        case -ENXIO:
+                                hsotg->uphy = NULL;
+                                break;
+                        case -EPROBE_DEFER:
+                                return ret;
+                        default:
+                                dev_err(hsotg->dev, "error getting usb phy %d\n",
+                                        ret);
+                                return ret;
+                        }
+                }
        }
+        hsotg->plat = dev_get_platdata(hsotg->dev);
        if (hsotg->phy) {
                /*
                 * If using the generic PHY framework, check if the PHY bus
@@ -229,11 +259,6 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
                        hsotg->phyif = GUSBCFG_PHYIF8;
        }
-        if (!hsotg->phy && !hsotg->uphy && !hsotg->plat) {
-                dev_err(hsotg->dev, "no platform data or transceiver defined\n");
-                return -EPROBE_DEFER;
-        }
        /* Clock */
        hsotg->clk = devm_clk_get(hsotg->dev, "otg");
        if (IS_ERR(hsotg->clk)) {
@@ -342,20 +367,6 @@ static int dwc2_driver_probe(struct platform_device *dev)
        if (retval)
                return retval;
-        irq = platform_get_irq(dev, 0);
-        if (irq < 0) {
-                dev_err(&dev->dev, "missing IRQ resource\n");
-                return irq;
-        }
-        dev_dbg(hsotg->dev, "registering common handler for irq%d\n",
-                irq);
-        retval = devm_request_irq(hsotg->dev, irq,
-                                  dwc2_handle_common_intr, IRQF_SHARED,
-                                  dev_name(hsotg->dev), hsotg);
-        if (retval)
-                return retval;
        res = platform_get_resource(dev, IORESOURCE_MEM, 0);
        hsotg->regs = devm_ioremap_resource(&dev->dev, res);
        if (IS_ERR(hsotg->regs))
@@ -390,6 +401,20 @@ static int dwc2_driver_probe(struct platform_device *dev)
        dwc2_set_all_params(hsotg->core_params, -1);
+        irq = platform_get_irq(dev, 0);
+        if (irq < 0) {
+                dev_err(&dev->dev, "missing IRQ resource\n");
+                return irq;
+        }
+        dev_dbg(hsotg->dev, "registering common handler for irq%d\n",
+                irq);
+        retval = devm_request_irq(hsotg->dev, irq,
+                                  dwc2_handle_common_intr, IRQF_SHARED,
+                                  dev_name(hsotg->dev), hsotg);
+        if (retval)
+                return retval;
        retval = dwc2_lowlevel_hw_enable(hsotg);
        if (retval)
                return retval;
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index e24a01cc98df..a58376fd65fe 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1078,6 +1078,7 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
         * little bit faster.
         */
        if (!usb_endpoint_xfer_isoc(dep->endpoint.desc) &&
+                        !usb_endpoint_xfer_int(dep->endpoint.desc) &&
                        !(dep->flags & DWC3_EP_BUSY)) {
                ret = __dwc3_gadget_kick_transfer(dep, 0, true);
                goto out;
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index adc6d52efa46..cf43e9e18368 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -423,7 +423,7 @@ static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
        spin_unlock_irq(&ffs->ev.waitq.lock);
        mutex_unlock(&ffs->mutex);
-        return unlikely(__copy_to_user(buf, events, size)) ? -EFAULT : size;
+        return unlikely(copy_to_user(buf, events, size)) ? -EFAULT : size;
 }
 static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
@@ -513,7 +513,7 @@ static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
                /* unlocks spinlock */
                ret = __ffs_ep0_queue_wait(ffs, data, len);
-                if (likely(ret > 0) && unlikely(__copy_to_user(buf, data, len)))
+                if (likely(ret > 0) && unlikely(copy_to_user(buf, data, len)))
                        ret = -EFAULT;
                goto done_mutex;
@@ -3493,7 +3493,7 @@ static char *ffs_prepare_buffer(const char __user *buf, size_t len)
        if (unlikely(!data))
                return ERR_PTR(-ENOMEM);
-        if (unlikely(__copy_from_user(data, buf, len))) {
+        if (unlikely(copy_from_user(data, buf, len))) {
                kfree(data);
                return ERR_PTR(-EFAULT);
        }
diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
index 42acb45e1ab4..898a570319f1 100644
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -370,6 +370,7 @@ static int f_midi_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
                if (err) {
                        ERROR(midi, "%s queue req: %d\n",
                                    midi->out_ep->name, err);
+                        free_ep_req(midi->out_ep, req);
                }
        }
@@ -545,7 +546,7 @@ static void f_midi_transmit(struct f_midi *midi, struct usb_request *req)
                }
        }
-        if (req->length > 0) {
+        if (req->length > 0 && ep->enabled) {
                int err;
                err = usb_ep_queue(ep, req, GFP_ATOMIC);
diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
index 289ebca316d3..ad8c9b05572d 100644
--- a/drivers/usb/gadget/function/uvc_configfs.c
+++ b/drivers/usb/gadget/function/uvc_configfs.c
@@ -20,7 +20,7 @@
 #define UVC_ATTR(prefix, cname, aname) \
 static struct configfs_attribute prefix##attr_##cname = { \
        .ca_name        = __stringify(aname),                           \
-        .ca_mode        = S_IRUGO,                                      \
+        .ca_mode        = S_IRUGO | S_IWUGO,                            \
        .ca_owner       = THIS_MODULE,                                  \
        .show           = prefix##cname##_show,                         \
        .store          = prefix##cname##_store,                        \
diff --git a/drivers/usb/gadget/udc/pxa27x_udc.c b/drivers/usb/gadget/udc/pxa27x_udc.c
index 670ac0b12f00..001a3b74a993 100644
--- a/drivers/usb/gadget/udc/pxa27x_udc.c
+++ b/drivers/usb/gadget/udc/pxa27x_udc.c
@@ -2536,6 +2536,9 @@ static int pxa_udc_suspend(struct platform_device *_dev, pm_message_t state)
        udc->pullup_resume = udc->pullup_on;
        dplus_pullup(udc, 0);
+        if (udc->driver)
+                udc->driver->disconnect(&udc->gadget);
        return 0;
 }
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 342ffd140122..8c6e15bd6ff0 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -473,6 +473,8 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
        if (!pdata)
                return -ENOMEM;
+        pdev->dev.platform_data = pdata;
        if (!of_property_read_u32(np, "num-ports", &ports))
                pdata->ports = ports;
@@ -483,6 +485,7 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
                 */
                if (i >= pdata->ports) {
                        pdata->vbus_pin[i] = -EINVAL;
+                        pdata->overcurrent_pin[i] = -EINVAL;
                        continue;
                }
@@ -513,10 +516,8 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
        }
        at91_for_each_port(i) {
-                if (i >= pdata->ports) {
+                if (i >= pdata->ports)
-                        pdata->overcurrent_pin[i] = -EINVAL;
+                        break;
-                        continue;
-                }
                pdata->overcurrent_pin[i] =
                        of_get_named_gpio_flags(np, "atmel,oc-gpio", i, &flags);
@@ -552,8 +553,6 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
                }
        }
-        pdev->dev.platform_data = pdata;
        device_init_wakeup(&pdev->dev, 1);
        return usb_hcd_at91_probe(&ohci_at91_hc_driver, pdev);
 }
diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
index dc31c425ce01..9f1c0538b211 100644
--- a/drivers/usb/host/whci/qset.c
+++ b/drivers/usb/host/whci/qset.c
@@ -377,6 +377,10 @@ static int qset_fill_page_list(struct whc *whc, struct whc_std *std, gfp_t mem_f
        if (std->pl_virt == NULL)
                return -ENOMEM;
        std->dma_addr = dma_map_single(whc->wusbhc.dev, std->pl_virt, pl_len, DMA_TO_DEVICE);
+        if (dma_mapping_error(whc->wusbhc.dev, std->dma_addr)) {
+                kfree(std->pl_virt);
+                return -EFAULT;
+        }
        for (p = 0; p < std->num_pointers; p++) {
                std->pl_virt[p].buf_ptr = cpu_to_le64(dma_addr);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 0230965fb78c..f980c239eded 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -733,8 +733,30 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                if ((raw_port_status & PORT_RESET) ||
                                !(raw_port_status & PORT_PE))
                        return 0xffffffff;
-                if (time_after_eq(jiffies,
+                /* did port event handler already start resume timing? */
-                                        bus_state->resume_done[wIndex])) {
+                if (!bus_state->resume_done[wIndex]) {
+                        /* If not, maybe we are in a host initated resume? */
+                        if (test_bit(wIndex, &bus_state->resuming_ports)) {
+                                /* Host initated resume doesn't time the resume
+                                 * signalling using resume_done[].
+                                 * It manually sets RESUME state, sleeps 20ms
+                                 * and sets U0 state. This should probably be
+                                 * changed, but not right now.
+                                 */
+                        } else {
+                                /* port resume was discovered now and here,
+                                 * start resume timing
+                                 */
+                                unsigned long timeout = jiffies +
+                                        msecs_to_jiffies(USB_RESUME_TIMEOUT);
+                                set_bit(wIndex, &bus_state->resuming_ports);
+                                bus_state->resume_done[wIndex] = timeout;
+                                mod_timer(&hcd->rh_timer, timeout);
+                        }
+                /* Has resume been signalled for USB_RESUME_TIME yet? */
+                } else if (time_after_eq(jiffies,
+                                         bus_state->resume_done[wIndex])) {
                        int time_left;
                        xhci_dbg(xhci, "Resume USB2 port %d\n",
@@ -775,13 +797,26 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                } else {
                        /*
                         * The resume has been signaling for less than
-                         * 20ms. Report the port status as SUSPEND,
+                         * USB_RESUME_TIME. Report the port status as SUSPEND,
-                         * let the usbcore check port status again
+                         * let the usbcore check port status again and clear
-                         * and clear resume signaling later.
+                         * resume signaling later.
                         */
                        status |= USB_PORT_STAT_SUSPEND;
                }
        }
+        /*
+         * Clear stale usb2 resume signalling variables in case port changed
+         * state during resume signalling. For example on error
+         */
+        if ((bus_state->resume_done[wIndex] ||
+             test_bit(wIndex, &bus_state->resuming_ports)) &&
+            (raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
+            (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
+                bus_state->resume_done[wIndex] = 0;
+                clear_bit(wIndex, &bus_state->resuming_ports);
+        }
        if ((raw_port_status & PORT_PLS_MASK) == XDEV_U0 &&
            (raw_port_status & PORT_POWER)) {
                if (bus_state->suspended_ports & (1 << wIndex)) {
@@ -1115,6 +1150,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                                if ((temp & PORT_PE) == 0)
                                        goto error;
+                                set_bit(wIndex, &bus_state->resuming_ports);
                                xhci_set_link_state(xhci, port_array, wIndex,
                                                        XDEV_RESUME);
                                spin_unlock_irqrestore(&xhci->lock, flags);
@@ -1122,6 +1158,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                                spin_lock_irqsave(&xhci->lock, flags);
                                xhci_set_link_state(xhci, port_array, wIndex,
                                                        XDEV_U0);
+                                clear_bit(wIndex, &bus_state->resuming_ports);
                        }
                        bus_state->port_c_suspend |= 1 << wIndex;
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 17f6897acde2..c62109091d12 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -188,10 +188,14 @@ static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev)
                0xb7, 0x0c, 0x34, 0xac, 0x01, 0xe9, 0xbf, 0x45,
                0xb7, 0xe6, 0x2b, 0x34, 0xec, 0x93, 0x1e, 0x23,
        };
-        acpi_evaluate_dsm(ACPI_HANDLE(&dev->dev), intel_dsm_uuid, 3, 1, NULL);
+        union acpi_object *obj;
+        obj = acpi_evaluate_dsm(ACPI_HANDLE(&dev->dev), intel_dsm_uuid, 3, 1,
+                                NULL);
+        ACPI_FREE(obj);
 }
 #else
-        static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev) { }
+static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev) { }
 #endif /* CONFIG_ACPI */
 /* called during probe() after chip reset completes */
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 6c5e8133cf87..eeaa6c6bd540 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1583,7 +1583,8 @@ static void handle_port_status(struct xhci_hcd *xhci,
                         */
                        bogus_port_status = true;
                        goto cleanup;
-                } else {
+                } else if (!test_bit(faked_port_index,
+                                     &bus_state->resuming_ports)) {
                        xhci_dbg(xhci, "resume HS port %d\n", port_id);
                        bus_state->resume_done[faked_port_index] = jiffies +
                                msecs_to_jiffies(USB_RESUME_TIMEOUT);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index dfa44d3e8eee..3f912705dcef 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4778,8 +4778,16 @@ int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev,
        ctrl_ctx->add_flags |= cpu_to_le32(SLOT_FLAG);
        slot_ctx = xhci_get_slot_ctx(xhci, config_cmd->in_ctx);
        slot_ctx->dev_info |= cpu_to_le32(DEV_HUB);
+        /*
+         * refer to section 6.2.2: MTT should be 0 for full speed hub,
+         * but it may be already set to 1 when setup an xHCI virtual
+         * device, so clear it anyway.
+         */
        if (tt->multi)
                slot_ctx->dev_info |= cpu_to_le32(DEV_MTT);
+        else if (hdev->speed == USB_SPEED_FULL)
+                slot_ctx->dev_info &= cpu_to_le32(~DEV_MTT);
        if (xhci->hci_version > 0x95) {
                xhci_dbg(xhci, "xHCI version %x needs hub "
                                "TT think time and number of ports\n",
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 1f2037bbeb0d..45c83baf675d 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -159,7 +159,7 @@ config USB_TI_CPPI_DMA
 config USB_TI_CPPI41_DMA
        bool 'TI CPPI 4.1 (AM335x)'
-        depends on ARCH_OMAP
+        depends on ARCH_OMAP && DMADEVICES
        select TI_CPPI41
 config USB_TUSB_OMAP_DMA
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 18cfc0a361cb..ee9ff7028b92 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2017,7 +2017,6 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
        /* We need musb_read/write functions initialized for PM */
        pm_runtime_use_autosuspend(musb->controller);
        pm_runtime_set_autosuspend_delay(musb->controller, 200);
-        pm_runtime_irq_safe(musb->controller);
        pm_runtime_enable(musb->controller);
        /* The musb_platform_init() call:
@@ -2095,6 +2094,7 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
 #ifndef CONFIG_MUSB_PIO_ONLY
        if (!musb->ops->dma_init || !musb->ops->dma_exit) {
                dev_err(dev, "DMA controller not set\n");
+                status = -ENODEV;
                goto fail2;
        }
        musb_dma_controller_create = musb->ops->dma_init;
@@ -2218,6 +2218,12 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
        pm_runtime_put(musb->controller);
+        /*
+         * For why this is currently needed, see commit 3e43a0725637
+         * ("usb: musb: core: add pm_runtime_irq_safe()")
+         */
+        pm_runtime_irq_safe(musb->controller);
        return 0;
 fail5:
diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
index 80eb991c2506..0d19a6d61a71 100644
--- a/drivers/usb/phy/phy-msm-usb.c
+++ b/drivers/usb/phy/phy-msm-usb.c
@@ -1506,7 +1506,6 @@ static int msm_otg_read_dt(struct platform_device *pdev, struct msm_otg *motg)
 {
        struct msm_otg_platform_data *pdata;
        struct extcon_dev *ext_id, *ext_vbus;
-        const struct of_device_id *id;
        struct device_node *node = pdev->dev.of_node;
        struct property *prop;
        int len, ret, words;
@@ -1518,8 +1517,9 @@ static int msm_otg_read_dt(struct platform_device *pdev, struct msm_otg *motg)
        motg->pdata = pdata;
-        id = of_match_device(msm_otg_dt_match, &pdev->dev);
+        pdata->phy_type = (enum msm_usb_phy_type)of_device_get_match_data(&pdev->dev);
-        pdata->phy_type = (enum msm_usb_phy_type) id->data;
+        if (!pdata->phy_type)
+                return 1;
        motg->link_rst = devm_reset_control_get(&pdev->dev, "link");
        if (IS_ERR(motg->link_rst))
diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
index b7536af777ab..c2936dc48ca7 100644
--- a/drivers/usb/phy/phy-mxs-usb.c
+++ b/drivers/usb/phy/phy-mxs-usb.c
@@ -143,12 +143,17 @@ static const struct mxs_phy_data imx6sx_phy_data = {
        .flags = MXS_PHY_DISCONNECT_LINE_WITHOUT_VBUS,
 };
+static const struct mxs_phy_data imx6ul_phy_data = {
+        .flags = MXS_PHY_DISCONNECT_LINE_WITHOUT_VBUS,
+};
 static const struct of_device_id mxs_phy_dt_ids[] = {
        { .compatible = "fsl,imx6sx-usbphy", .data = &imx6sx_phy_data, },
        { .compatible = "fsl,imx6sl-usbphy", .data = &imx6sl_phy_data, },
        { .compatible = "fsl,imx6q-usbphy", .data = &imx6q_phy_data, },
        { .compatible = "fsl,imx23-usbphy", .data = &imx23_phy_data, },
        { .compatible = "fsl,vf610-usbphy", .data = &vf610_phy_data, },
+        { .compatible = "fsl,imx6ul-usbphy", .data = &imx6ul_phy_data, },
        { /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, mxs_phy_dt_ids);
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index de4f97d84a82..8f7a78e70975 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -131,7 +131,8 @@ static void __usbhsg_queue_pop(struct usbhsg_uep *uep,
        struct device *dev = usbhsg_gpriv_to_dev(gpriv);
        struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
-        dev_dbg(dev, "pipe %d : queue pop\n", usbhs_pipe_number(pipe));
+        if (pipe)
+                dev_dbg(dev, "pipe %d : queue pop\n", usbhs_pipe_number(pipe));
        ureq->req.status = status;
        spin_unlock(usbhs_priv_to_lock(priv));
@@ -685,7 +686,13 @@ static int usbhsg_ep_dequeue(struct usb_ep *ep, struct usb_request *req)
        struct usbhsg_request *ureq = usbhsg_req_to_ureq(req);
        struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
-        usbhs_pkt_pop(pipe, usbhsg_ureq_to_pkt(ureq));
+        if (pipe)
+                usbhs_pkt_pop(pipe, usbhsg_ureq_to_pkt(ureq));
+        /*
+         * To dequeue a request, this driver should call the usbhsg_queue_pop()
+         * even if the pipe is NULL.
+         */
        usbhsg_queue_pop(uep, ureq, -ECONNRESET);
        return 0;
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index eac7ccaa3c85..7d4f51a32e66 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -132,7 +132,6 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
-        { USB_DEVICE(0x10C4, 0xEA80) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */
        { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */
        { USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */
diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index 3658662898fc..a204782ae530 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -53,6 +53,7 @@ DEVICE(funsoft, FUNSOFT_IDS);
 /* Infineon Flashloader driver */
 #define FLASHLOADER_IDS()               \
+        { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \
        { USB_DEVICE(0x8087, 0x0716) }
 DEVICE(flashloader, FLASHLOADER_IDS);
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index e69151664436..5c66d3f7a6d0 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -796,6 +796,10 @@ static int uas_slave_configure(struct scsi_device *sdev)
        if (devinfo->flags & US_FL_NO_REPORT_OPCODES)
                sdev->no_report_opcodes = 1;
+        /* A few buggy USB-ATA bridges don't understand FUA */
+        if (devinfo->flags & US_FL_BROKEN_FUA)
+                sdev->broken_fua = 1;
        scsi_change_queue_depth(sdev, devinfo->qdepth - 2);
        return 0;
 }
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 6b2479123de7..7ffe4209067b 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1987,7 +1987,7 @@ UNUSUAL_DEV(  0x14cd, 0x6600, 0x0201, 0x0201,
                US_FL_IGNORE_RESIDUE ),
 /* Reported by Michael Büsch <m@bues.ch> */
-UNUSUAL_DEV(  0x152d, 0x0567, 0x0114, 0x0114,
+UNUSUAL_DEV(  0x152d, 0x0567, 0x0114, 0x0116,
                "JMicron",
                "USB to ATA/ATAPI Bridge",
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index c85ea530085f..ccc113e83d88 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -132,7 +132,7 @@ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
                "JMicron",
                "JMS567",
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-                US_FL_NO_REPORT_OPCODES),
+                US_FL_BROKEN_FUA | US_FL_NO_REPORT_OPCODES),
 /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
 UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
diff --git a/drivers/vfio/Kconfig b/drivers/vfio/Kconfig
index da6e2ce77495..850d86ca685b 100644
--- a/drivers/vfio/Kconfig
+++ b/drivers/vfio/Kconfig
@@ -31,21 +31,6 @@ menuconfig VFIO
          If you don't know what to do here, say N.
-menuconfig VFIO_NOIOMMU
-        bool "VFIO No-IOMMU support"
-        depends on VFIO
-        help
-          VFIO is built on the ability to isolate devices using the IOMMU.
-          Only with an IOMMU can userspace access to DMA capable devices be
-          considered secure.  VFIO No-IOMMU mode enables IOMMU groups for
-          devices without IOMMU backing for the purpose of re-using the VFIO
-          infrastructure in a non-secure mode.  Use of this mode will result
-          in an unsupportable kernel and will therefore taint the kernel.
-          Device assignment to virtual machines is also not possible with
-          this mode since there is no IOMMU to provide DMA translation.
-          If you don't know what to do here, say N.
 source "drivers/vfio/pci/Kconfig"
 source "drivers/vfio/platform/Kconfig"
 source "virt/lib/Kconfig"
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 32b88bd2c82c..56bf6dbb93db 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -940,13 +940,13 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL)
                return -EINVAL;
-        group = vfio_iommu_group_get(&pdev->dev);
+        group = iommu_group_get(&pdev->dev);
        if (!group)
                return -EINVAL;
        vdev = kzalloc(sizeof(*vdev), GFP_KERNEL);
        if (!vdev) {
-                vfio_iommu_group_put(group, &pdev->dev);
+                iommu_group_put(group);
                return -ENOMEM;
        }
@@ -957,7 +957,7 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        ret = vfio_add_group_dev(&pdev->dev, &vfio_pci_ops, vdev);
        if (ret) {
-                vfio_iommu_group_put(group, &pdev->dev);
+                iommu_group_put(group);
                kfree(vdev);
                return ret;
        }
@@ -993,7 +993,7 @@ static void vfio_pci_remove(struct pci_dev *pdev)
        if (!vdev)
                return;
-        vfio_iommu_group_put(pdev->dev.iommu_group, &pdev->dev);
+        iommu_group_put(pdev->dev.iommu_group);
        kfree(vdev);
        if (vfio_pci_is_vga(pdev)) {
@@ -1035,7 +1035,7 @@ static pci_ers_result_t vfio_pci_aer_err_detected(struct pci_dev *pdev,
        return PCI_ERS_RESULT_CAN_RECOVER;
 }
-static struct pci_error_handlers vfio_err_handlers = {
+static const struct pci_error_handlers vfio_err_handlers = {
        .error_detected = vfio_pci_aer_err_detected,
 };
diff --git a/drivers/vfio/platform/vfio_platform.c b/drivers/vfio/platform/vfio_platform.c
index f1625dcfbb23..b1cc3a768784 100644
--- a/drivers/vfio/platform/vfio_platform.c
+++ b/drivers/vfio/platform/vfio_platform.c
@@ -92,7 +92,6 @@ static struct platform_driver vfio_platform_driver = {
        .remove         = vfio_platform_remove,
        .driver = {
                .name   = "vfio-platform",
-                .owner  = THIS_MODULE,
        },
 };
diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c
index a1c50d630792..418cdd9ba3f4 100644
--- a/drivers/vfio/platform/vfio_platform_common.c
+++ b/drivers/vfio/platform/vfio_platform_common.c
@@ -51,13 +51,10 @@ static vfio_platform_reset_fn_t vfio_platform_lookup_reset(const char *compat,
 static void vfio_platform_get_reset(struct vfio_platform_device *vdev)
 {
-        char modname[256];
        vdev->reset = vfio_platform_lookup_reset(vdev->compat,
                                                &vdev->reset_module);
        if (!vdev->reset) {
-                snprintf(modname, 256, "vfio-reset:%s", vdev->compat);
+                request_module("vfio-reset:%s", vdev->compat);
-                request_module(modname);
                vdev->reset = vfio_platform_lookup_reset(vdev->compat,
                                                         &vdev->reset_module);
        }
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index de632da2e22f..6070b793cbcb 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -62,7 +62,6 @@ struct vfio_container {
        struct rw_semaphore             group_lock;
        struct vfio_iommu_driver        *iommu_driver;
        void                            *iommu_data;
-        bool                            noiommu;
 };
 struct vfio_unbound_dev {
@@ -85,7 +84,6 @@ struct vfio_group {
        struct list_head                unbound_list;
        struct mutex                    unbound_lock;
        atomic_t                        opened;
-        bool                            noiommu;
 };
 struct vfio_device {
@@ -97,147 +95,6 @@ struct vfio_device {
        void                            *device_data;
 };
-#ifdef CONFIG_VFIO_NOIOMMU
-static bool noiommu __read_mostly;
-module_param_named(enable_unsafe_noiommu_support,
-                   noiommu, bool, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(enable_unsafe_noiommu_mode, "Enable UNSAFE, no-IOMMU mode.  This mode provides no device isolation, no DMA translation, no host kernel protection, cannot be used for device assignment to virtual machines, requires RAWIO permissions, and will taint the kernel.  If you do not know what this is for, step away. (default: false)");
-#endif
-/*
- * vfio_iommu_group_{get,put} are only intended for VFIO bus driver probe
- * and remove functions, any use cases other than acquiring the first
- * reference for the purpose of calling vfio_add_group_dev() or removing
- * that symmetric reference after vfio_del_group_dev() should use the raw
- * iommu_group_{get,put} functions.  In particular, vfio_iommu_group_put()
- * removes the device from the dummy group and cannot be nested.
- */
-struct iommu_group *vfio_iommu_group_get(struct device *dev)
-{
-        struct iommu_group *group;
-        int __maybe_unused ret;
-        group = iommu_group_get(dev);
-#ifdef CONFIG_VFIO_NOIOMMU
-        /*
-         * With noiommu enabled, an IOMMU group will be created for a device
-         * that doesn't already have one and doesn't have an iommu_ops on their
-         * bus.  We use iommu_present() again in the main code to detect these
-         * fake groups.
-         */
-        if (group || !noiommu || iommu_present(dev->bus))
-                return group;
-        group = iommu_group_alloc();
-        if (IS_ERR(group))
-                return NULL;
-        iommu_group_set_name(group, "vfio-noiommu");
-        ret = iommu_group_add_device(group, dev);
-        iommu_group_put(group);
-        if (ret)
-                return NULL;
-        /*
-         * Where to taint?  At this point we've added an IOMMU group for a
-         * device that is not backed by iommu_ops, therefore any iommu_
-         * callback using iommu_ops can legitimately Oops.  So, while we may
-         * be about to give a DMA capable device to a user without IOMMU
-         * protection, which is clearly taint-worthy, let's go ahead and do
-         * it here.
-         */
-        add_taint(TAINT_USER, LOCKDEP_STILL_OK);
-        dev_warn(dev, "Adding kernel taint for vfio-noiommu group on device\n");
-#endif
-        return group;
-}
-EXPORT_SYMBOL_GPL(vfio_iommu_group_get);
-void vfio_iommu_group_put(struct iommu_group *group, struct device *dev)
-{
-#ifdef CONFIG_VFIO_NOIOMMU
-        if (!iommu_present(dev->bus))
-                iommu_group_remove_device(dev);
-#endif
-        iommu_group_put(group);
-}
-EXPORT_SYMBOL_GPL(vfio_iommu_group_put);
-#ifdef CONFIG_VFIO_NOIOMMU
-static void *vfio_noiommu_open(unsigned long arg)
-{
-        if (arg != VFIO_NOIOMMU_IOMMU)
-                return ERR_PTR(-EINVAL);
-        if (!capable(CAP_SYS_RAWIO))
-                return ERR_PTR(-EPERM);
-        return NULL;
-}
-static void vfio_noiommu_release(void *iommu_data)
-{
-}
-static long vfio_noiommu_ioctl(void *iommu_data,
-                               unsigned int cmd, unsigned long arg)
-{
-        if (cmd == VFIO_CHECK_EXTENSION)
-                return arg == VFIO_NOIOMMU_IOMMU ? 1 : 0;
-        return -ENOTTY;
-}
-static int vfio_iommu_present(struct device *dev, void *unused)
-{
-        return iommu_present(dev->bus) ? 1 : 0;
-}
-static int vfio_noiommu_attach_group(void *iommu_data,
-                                     struct iommu_group *iommu_group)
-{
-        return iommu_group_for_each_dev(iommu_group, NULL,
-                                        vfio_iommu_present) ? -EINVAL : 0;
-}
-static void vfio_noiommu_detach_group(void *iommu_data,
-                                      struct iommu_group *iommu_group)
-{
-}
-static struct vfio_iommu_driver_ops vfio_noiommu_ops = {
-        .name = "vfio-noiommu",
-        .owner = THIS_MODULE,
-        .open = vfio_noiommu_open,
-        .release = vfio_noiommu_release,
-        .ioctl = vfio_noiommu_ioctl,
-        .attach_group = vfio_noiommu_attach_group,
-        .detach_group = vfio_noiommu_detach_group,
-};
-static struct vfio_iommu_driver vfio_noiommu_driver = {
-        .ops = &vfio_noiommu_ops,
-};
-/*
- * Wrap IOMMU drivers, the noiommu driver is the one and only driver for
- * noiommu groups (and thus containers) and not available for normal groups.
- */
-#define vfio_for_each_iommu_driver(con, pos)                            \
-        for (pos = con->noiommu ? &vfio_noiommu_driver :                \
-             list_first_entry(&vfio.iommu_drivers_list,                 \
-                              struct vfio_iommu_driver, vfio_next);     \
-             (con->noiommu ? pos != NULL :                              \
-                        &pos->vfio_next != &vfio.iommu_drivers_list);   \
-              pos = con->noiommu ? NULL : list_next_entry(pos, vfio_next))
-#else
-#define vfio_for_each_iommu_driver(con, pos)                            \
-        list_for_each_entry(pos, &vfio.iommu_drivers_list, vfio_next)
-#endif
 /**
 * IOMMU driver registration
 */
@@ -342,8 +199,7 @@ static void vfio_group_unlock_and_free(struct vfio_group *group)
 /**
 * Group objects - create, release, get, put, search
 */
-static struct vfio_group *vfio_create_group(struct iommu_group *iommu_group,
+static struct vfio_group *vfio_create_group(struct iommu_group *iommu_group)
-                                            bool noiommu)
 {
        struct vfio_group *group, *tmp;
        struct device *dev;
@@ -361,7 +217,6 @@ static struct vfio_group *vfio_create_group(struct iommu_group *iommu_group,
        atomic_set(&group->container_users, 0);
        atomic_set(&group->opened, 0);
        group->iommu_group = iommu_group;
-        group->noiommu = noiommu;
        group->nb.notifier_call = vfio_iommu_group_notifier;
@@ -397,8 +252,7 @@ static struct vfio_group *vfio_create_group(struct iommu_group *iommu_group,
        dev = device_create(vfio.class, NULL,
                            MKDEV(MAJOR(vfio.group_devt), minor),
-                            group, "%s%d", noiommu ? "noiommu-" : "",
+                            group, "%d", iommu_group_id(iommu_group));
-                            iommu_group_id(iommu_group));
        if (IS_ERR(dev)) {
                vfio_free_group_minor(minor);
                vfio_group_unlock_and_free(group);
@@ -682,7 +536,7 @@ static int vfio_group_nb_add_dev(struct vfio_group *group, struct device *dev)
                return 0;
        /* TODO Prevent device auto probing */
-        WARN("Device %s added to live group %d!\n", dev_name(dev),
+        WARN(1, "Device %s added to live group %d!\n", dev_name(dev),
             iommu_group_id(group->iommu_group));
        return 0;
@@ -786,8 +640,7 @@ int vfio_add_group_dev(struct device *dev,
        group = vfio_group_get_from_iommu(iommu_group);
        if (!group) {
-                group = vfio_create_group(iommu_group,
+                group = vfio_create_group(iommu_group);
-                                          !iommu_present(dev->bus));
                if (IS_ERR(group)) {
                        iommu_group_put(iommu_group);
                        return PTR_ERR(group);
@@ -999,7 +852,8 @@ static long vfio_ioctl_check_extension(struct vfio_container *container,
                 */
                if (!driver) {
                        mutex_lock(&vfio.iommu_drivers_lock);
-                        vfio_for_each_iommu_driver(container, driver) {
+                        list_for_each_entry(driver, &vfio.iommu_drivers_list,
+                                            vfio_next) {
                                if (!try_module_get(driver->ops->owner))
                                        continue;
@@ -1068,7 +922,7 @@ static long vfio_ioctl_set_iommu(struct vfio_container *container,
        }
        mutex_lock(&vfio.iommu_drivers_lock);
-        vfio_for_each_iommu_driver(container, driver) {
+        list_for_each_entry(driver, &vfio.iommu_drivers_list, vfio_next) {
                void *data;
                if (!try_module_get(driver->ops->owner))
@@ -1333,9 +1187,6 @@ static int vfio_group_set_container(struct vfio_group *group, int container_fd)
        if (atomic_read(&group->container_users))
                return -EINVAL;
-        if (group->noiommu && !capable(CAP_SYS_RAWIO))
-                return -EPERM;
        f = fdget(container_fd);
        if (!f.file)
                return -EBADF;
@@ -1351,13 +1202,6 @@ static int vfio_group_set_container(struct vfio_group *group, int container_fd)
        down_write(&container->group_lock);
-        /* Real groups and fake groups cannot mix */
-        if (!list_empty(&container->group_list) &&
-            container->noiommu != group->noiommu) {
-                ret = -EPERM;
-                goto unlock_out;
-        }
        driver = container->iommu_driver;
        if (driver) {
                ret = driver->ops->attach_group(container->iommu_data,
@@ -1367,7 +1211,6 @@ static int vfio_group_set_container(struct vfio_group *group, int container_fd)
        }
        group->container = container;
-        container->noiommu = group->noiommu;
        list_add(&group->container_next, &container->group_list);
        /* Get a reference on the container and mark a user within the group */
@@ -1398,9 +1241,6 @@ static int vfio_group_get_device_fd(struct vfio_group *group, char *buf)
            !group->container->iommu_driver || !vfio_group_viable(group))
                return -EINVAL;
-        if (group->noiommu && !capable(CAP_SYS_RAWIO))
-                return -EPERM;
        device = vfio_device_get_from_name(group, buf);
        if (!device)
                return -ENODEV;
@@ -1443,10 +1283,6 @@ static int vfio_group_get_device_fd(struct vfio_group *group, char *buf)
        fd_install(ret, filep);
-        if (group->noiommu)
-                dev_warn(device->dev, "vfio-noiommu device opened by user "
-                         "(%s:%d)\n", current->comm, task_pid_nr(current));
        return ret;
 }
@@ -1535,11 +1371,6 @@ static int vfio_group_fops_open(struct inode *inode, struct file *filep)
        if (!group)
                return -ENODEV;
-        if (group->noiommu && !capable(CAP_SYS_RAWIO)) {
-                vfio_group_put(group);
-                return -EPERM;
-        }
        /* Do we need multiple instances of the group open?  Seems not. */
        opened = atomic_cmpxchg(&group->opened, 0, 1);
        if (opened) {
@@ -1702,11 +1533,6 @@ struct vfio_group *vfio_group_get_external_user(struct file *filep)
        if (!atomic_inc_not_zero(&group->container_users))
                return ERR_PTR(-EINVAL);
-        if (group->noiommu) {
-                atomic_dec(&group->container_users);
-                return ERR_PTR(-EPERM);
-        }
        if (!group->container->iommu_driver ||
                        !vfio_group_viable(group)) {
                atomic_dec(&group->container_users);
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index eec2f11809ff..ad2146a9ab2d 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -819,7 +819,7 @@ long vhost_vring_ioctl(struct vhost_dev *d, int ioctl, void __user *argp)
                BUILD_BUG_ON(__alignof__ *vq->used > VRING_USED_ALIGN_SIZE);
                if ((a.avail_user_addr & (VRING_AVAIL_ALIGN_SIZE - 1)) ||
                    (a.used_user_addr & (VRING_USED_ALIGN_SIZE - 1)) ||
-                    (a.log_guest_addr & (sizeof(u64) - 1))) {
+                    (a.log_guest_addr & (VRING_USED_ALIGN_SIZE - 1))) {
                        r = -EINVAL;
                        break;
                }
@@ -1369,7 +1369,7 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq,
        /* Grab the next descriptor number they're advertising, and increment
         * the index we've seen. */
        if (unlikely(__get_user(ring_head,
-                                &vq->avail->ring[last_avail_idx % vq->num]))) {
+                                &vq->avail->ring[last_avail_idx & (vq->num - 1)]))) {
                vq_err(vq, "Failed to read head: idx %d address %p\n",
                       last_avail_idx,
                       &vq->avail->ring[last_avail_idx % vq->num]);
@@ -1489,7 +1489,7 @@ static int __vhost_add_used_n(struct vhost_virtqueue *vq,
        u16 old, new;
        int start;
-        start = vq->last_used_idx % vq->num;
+        start = vq->last_used_idx & (vq->num - 1);
        used = vq->used->ring + start;
        if (count == 1) {
                if (__put_user(heads[0].id, &used->id)) {
@@ -1531,7 +1531,7 @@ int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads,
 {
        int start, n, r;
-        start = vq->last_used_idx % vq->num;
+        start = vq->last_used_idx & (vq->num - 1);
        n = vq->num - start;
        if (n < count) {
                r = __vhost_add_used_n(vq, heads, n);
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index b1877d73fa56..7062bb0975a5 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -412,6 +412,7 @@ static int virtio_init(void)
 static void __exit virtio_exit(void)
 {
        bus_unregister(&virtio_bus);
+        ida_destroy(&virtio_index_ida);
 }
 core_initcall(virtio_init);
 module_exit(virtio_exit);
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 096b857e7b75..ee663c458b20 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -80,6 +80,12 @@ struct vring_virtqueue {
        /* Last used index we've seen. */
        u16 last_used_idx;
+        /* Last written value to avail->flags */
+        u16 avail_flags_shadow;
+        /* Last written value to avail->idx in guest byte order */
+        u16 avail_idx_shadow;
        /* How to notify other side. FIXME: commonalize hcalls! */
        bool (*notify)(struct virtqueue *vq);
@@ -109,7 +115,7 @@ static struct vring_desc *alloc_indirect(struct virtqueue *_vq,
         * otherwise virt_to_phys will give us bogus addresses in the
         * virtqueue.
         */
-        gfp &= ~(__GFP_HIGHMEM | __GFP_HIGH);
+        gfp &= ~__GFP_HIGHMEM;
        desc = kmalloc(total_sg * sizeof(struct vring_desc), gfp);
        if (!desc)
@@ -235,13 +241,14 @@ static inline int virtqueue_add(struct virtqueue *_vq,
        /* Put entry in available array (but don't update avail->idx until they
         * do sync). */
-        avail = virtio16_to_cpu(_vq->vdev, vq->vring.avail->idx) & (vq->vring.num - 1);
+        avail = vq->avail_idx_shadow & (vq->vring.num - 1);
        vq->vring.avail->ring[avail] = cpu_to_virtio16(_vq->vdev, head);
        /* Descriptors and available array need to be set before we expose the
         * new available array entries. */
        virtio_wmb(vq->weak_barriers);
-        vq->vring.avail->idx = cpu_to_virtio16(_vq->vdev, virtio16_to_cpu(_vq->vdev, vq->vring.avail->idx) + 1);
+        vq->avail_idx_shadow++;
+        vq->vring.avail->idx = cpu_to_virtio16(_vq->vdev, vq->avail_idx_shadow);
        vq->num_added++;
        pr_debug("Added buffer head %i to %p\n", head, vq);
@@ -354,8 +361,8 @@ bool virtqueue_kick_prepare(struct virtqueue *_vq)
         * event. */
        virtio_mb(vq->weak_barriers);
-        old = virtio16_to_cpu(_vq->vdev, vq->vring.avail->idx) - vq->num_added;
+        old = vq->avail_idx_shadow - vq->num_added;
-        new = virtio16_to_cpu(_vq->vdev, vq->vring.avail->idx);
+        new = vq->avail_idx_shadow;
        vq->num_added = 0;
 #ifdef DEBUG
@@ -510,7 +517,7 @@ void *virtqueue_get_buf(struct virtqueue *_vq, unsigned int *len)
        /* If we expect an interrupt for the next entry, tell host
         * by writing event index and flush out the write before
         * the read in the next get_buf call. */
-        if (!(vq->vring.avail->flags & cpu_to_virtio16(_vq->vdev, VRING_AVAIL_F_NO_INTERRUPT))) {
+        if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) {
                vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, vq->last_used_idx);
                virtio_mb(vq->weak_barriers);
        }
@@ -537,7 +544,11 @@ void virtqueue_disable_cb(struct virtqueue *_vq)
 {
        struct vring_virtqueue *vq = to_vvq(_vq);
-        vq->vring.avail->flags |= cpu_to_virtio16(_vq->vdev, VRING_AVAIL_F_NO_INTERRUPT);
+        if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) {
+                vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
+                vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+        }
 }
 EXPORT_SYMBOL_GPL(virtqueue_disable_cb);
@@ -565,7 +576,10 @@ unsigned virtqueue_enable_cb_prepare(struct virtqueue *_vq)
        /* Depending on the VIRTIO_RING_F_EVENT_IDX feature, we need to
         * either clear the flags bit or point the event index at the next
         * entry. Always do both to keep code simple. */
-        vq->vring.avail->flags &= cpu_to_virtio16(_vq->vdev, ~VRING_AVAIL_F_NO_INTERRUPT);
+        if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
+                vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
+                vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+        }
        vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, last_used_idx = vq->last_used_idx);
        END_USE(vq);
        return last_used_idx;
@@ -633,9 +647,12 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *_vq)
        /* Depending on the VIRTIO_RING_F_USED_EVENT_IDX feature, we need to
         * either clear the flags bit or point the event index at the next
         * entry. Always do both to keep code simple. */
-        vq->vring.avail->flags &= cpu_to_virtio16(_vq->vdev, ~VRING_AVAIL_F_NO_INTERRUPT);
+        if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
+                vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
+                vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+        }
        /* TODO: tune this threshold */
-        bufs = (u16)(virtio16_to_cpu(_vq->vdev, vq->vring.avail->idx) - vq->last_used_idx) * 3 / 4;
+        bufs = (u16)(vq->avail_idx_shadow - vq->last_used_idx) * 3 / 4;
        vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, vq->last_used_idx + bufs);
        virtio_mb(vq->weak_barriers);
        if (unlikely((u16)(virtio16_to_cpu(_vq->vdev, vq->vring.used->idx) - vq->last_used_idx) > bufs)) {
@@ -670,7 +687,8 @@ void *virtqueue_detach_unused_buf(struct virtqueue *_vq)
                /* detach_buf clears data, so grab it now. */
                buf = vq->data[i];
                detach_buf(vq, i);
-                vq->vring.avail->idx = cpu_to_virtio16(_vq->vdev, virtio16_to_cpu(_vq->vdev, vq->vring.avail->idx) - 1);
+                vq->avail_idx_shadow--;
+                vq->vring.avail->idx = cpu_to_virtio16(_vq->vdev, vq->avail_idx_shadow);
                END_USE(vq);
                return buf;
        }
@@ -735,6 +753,8 @@ struct virtqueue *vring_new_virtqueue(unsigned int index,
        vq->weak_barriers = weak_barriers;
        vq->broken = false;
        vq->last_used_idx = 0;
+        vq->avail_flags_shadow = 0;
+        vq->avail_idx_shadow = 0;
        vq->num_added = 0;
        list_add_tail(&vq->vq.list, &vdev->vqs);
 #ifdef DEBUG
@@ -746,8 +766,10 @@ struct virtqueue *vring_new_virtqueue(unsigned int index,
        vq->event = virtio_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX);
        /* No callback?  Tell other side not to bother us. */
-        if (!callback)
+        if (!callback) {
-                vq->vring.avail->flags |= cpu_to_virtio16(vdev, VRING_AVAIL_F_NO_INTERRUPT);
+                vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
+                vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow);
+        }
        /* Put everything in free lists. */
        vq->free_head = 0;
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 699941e90667..511078586fa1 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -451,9 +451,9 @@ void v9fs_evict_inode(struct inode *inode)
 {
        struct v9fs_inode *v9inode = V9FS_I(inode);
-        truncate_inode_pages_final(inode->i_mapping);
+        truncate_inode_pages_final(&inode->i_data);
        clear_inode(inode);
-        filemap_fdatawrite(inode->i_mapping);
+        filemap_fdatawrite(&inode->i_data);
        v9fs_cache_inode_put_cookie(inode);
        /* clunk the fid stashed in writeback_fid */
diff --git a/fs/block_dev.c b/fs/block_dev.c
index c25639e907bd..5c0b2cba870e 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -156,11 +156,16 @@ blkdev_get_block(struct inode *inode, sector_t iblock,
        return 0;
 }
+static struct inode *bdev_file_inode(struct file *file)
+{
+        return file->f_mapping->host;
+}
 static ssize_t
 blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset)
 {
        struct file *file = iocb->ki_filp;
-        struct inode *inode = file->f_mapping->host;
+        struct inode *inode = bdev_file_inode(file);
        if (IS_DAX(inode))
                return dax_do_io(iocb, inode, iter, offset, blkdev_get_block,
@@ -338,7 +343,7 @@ static int blkdev_write_end(struct file *file, struct address_space *mapping,
 */
 static loff_t block_llseek(struct file *file, loff_t offset, int whence)
 {
-        struct inode *bd_inode = file->f_mapping->host;
+        struct inode *bd_inode = bdev_file_inode(file);
        loff_t retval;
        mutex_lock(&bd_inode->i_mutex);
@@ -349,7 +354,7 @@ static loff_t block_llseek(struct file *file, loff_t offset, int whence)
        
 int blkdev_fsync(struct file *filp, loff_t start, loff_t end, int datasync)
 {
-        struct inode *bd_inode = filp->f_mapping->host;
+        struct inode *bd_inode = bdev_file_inode(filp);
        struct block_device *bdev = I_BDEV(bd_inode);
        int error;
        
@@ -1230,8 +1235,11 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                                }
                        }
-                        if (!ret)
+                        if (!ret) {
                                bd_set_size(bdev,(loff_t)get_capacity(disk)<<9);
+                                if (!blkdev_dax_capable(bdev))
+                                        bdev->bd_inode->i_flags &= ~S_DAX;
+                        }
                        /*
                         * If the device is invalidated, rescan partition
@@ -1245,6 +1253,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                                else if (ret == -ENOMEDIUM)
                                        invalidate_partitions(disk, bdev);
                        }
                        if (ret)
                                goto out_clear;
                } else {
@@ -1265,12 +1274,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                                goto out_clear;
                        }
                        bd_set_size(bdev, (loff_t)bdev->bd_part->nr_sects << 9);
-                        /*
+                        if (!blkdev_dax_capable(bdev))
-                         * If the partition is not aligned on a page
-                         * boundary, we can't do dax I/O to it.
-                         */
-                        if ((bdev->bd_part->start_sect % (PAGE_SIZE / 512)) ||
-                            (bdev->bd_part->nr_sects % (PAGE_SIZE / 512)))
                                bdev->bd_inode->i_flags &= ~S_DAX;
                }
        } else {
@@ -1523,11 +1527,14 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part)
                WARN_ON_ONCE(bdev->bd_holders);
                sync_blockdev(bdev);
                kill_bdev(bdev);
+                bdev_write_inode(bdev);
                /*
-                 * ->release can cause the queue to disappear, so flush all
+                 * Detaching bdev inode from its wb in __destroy_inode()
-                 * dirty data before.
+                 * is too late: the queue which embeds its bdi (along with
+                 * root wb) can be gone as soon as we put_disk() below.
                 */
-                bdev_write_inode(bdev);
+                inode_detach_wb(bdev->bd_inode);
        }
        if (bdev->bd_contains == bdev) {
                if (disk->fops->release)
@@ -1602,14 +1609,14 @@ EXPORT_SYMBOL(blkdev_put);
 static int blkdev_close(struct inode * inode, struct file * filp)
 {
-        struct block_device *bdev = I_BDEV(filp->f_mapping->host);
+        struct block_device *bdev = I_BDEV(bdev_file_inode(filp));
        blkdev_put(bdev, filp->f_mode);
        return 0;
 }
 static long block_ioctl(struct file *file, unsigned cmd, unsigned long arg)
 {
-        struct block_device *bdev = I_BDEV(file->f_mapping->host);
+        struct block_device *bdev = I_BDEV(bdev_file_inode(file));
        fmode_t mode = file->f_mode;
        /*
@@ -1634,7 +1641,7 @@ static long block_ioctl(struct file *file, unsigned cmd, unsigned long arg)
 ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from)
 {
        struct file *file = iocb->ki_filp;
-        struct inode *bd_inode = file->f_mapping->host;
+        struct inode *bd_inode = bdev_file_inode(file);
        loff_t size = i_size_read(bd_inode);
        struct blk_plug plug;
        ssize_t ret;
@@ -1666,7 +1673,7 @@ EXPORT_SYMBOL_GPL(blkdev_write_iter);
 ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
 {
        struct file *file = iocb->ki_filp;
-        struct inode *bd_inode = file->f_mapping->host;
+        struct inode *bd_inode = bdev_file_inode(file);
        loff_t size = i_size_read(bd_inode);
        loff_t pos = iocb->ki_pos;
@@ -1705,13 +1712,101 @@ static const struct address_space_operations def_blk_aops = {
        .is_dirty_writeback = buffer_check_dirty_writeback,
 };
+#ifdef CONFIG_FS_DAX
+/*
+ * In the raw block case we do not need to contend with truncation nor
+ * unwritten file extents.  Without those concerns there is no need for
+ * additional locking beyond the mmap_sem context that these routines
+ * are already executing under.
+ *
+ * Note, there is no protection if the block device is dynamically
+ * resized (partition grow/shrink) during a fault. A stable block device
+ * size is already not enforced in the blkdev_direct_IO path.
+ *
+ * For DAX, it is the responsibility of the block device driver to
+ * ensure the whole-disk device size is stable while requests are in
+ * flight.
+ *
+ * Finally, unlike the filemap_page_mkwrite() case there is no
+ * filesystem superblock to sync against freezing.  We still include a
+ * pfn_mkwrite callback for dax drivers to receive write fault
+ * notifications.
+ */
+static int blkdev_dax_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+        return __dax_fault(vma, vmf, blkdev_get_block, NULL);
+}
+static int blkdev_dax_pmd_fault(struct vm_area_struct *vma, unsigned long addr,
+                pmd_t *pmd, unsigned int flags)
+{
+        return __dax_pmd_fault(vma, addr, pmd, flags, blkdev_get_block, NULL);
+}
+static void blkdev_vm_open(struct vm_area_struct *vma)
+{
+        struct inode *bd_inode = bdev_file_inode(vma->vm_file);
+        struct block_device *bdev = I_BDEV(bd_inode);
+        mutex_lock(&bd_inode->i_mutex);
+        bdev->bd_map_count++;
+        mutex_unlock(&bd_inode->i_mutex);
+}
+static void blkdev_vm_close(struct vm_area_struct *vma)
+{
+        struct inode *bd_inode = bdev_file_inode(vma->vm_file);
+        struct block_device *bdev = I_BDEV(bd_inode);
+        mutex_lock(&bd_inode->i_mutex);
+        bdev->bd_map_count--;
+        mutex_unlock(&bd_inode->i_mutex);
+}
+static const struct vm_operations_struct blkdev_dax_vm_ops = {
+        .open           = blkdev_vm_open,
+        .close          = blkdev_vm_close,
+        .fault          = blkdev_dax_fault,
+        .pmd_fault      = blkdev_dax_pmd_fault,
+        .pfn_mkwrite    = blkdev_dax_fault,
+};
+static const struct vm_operations_struct blkdev_default_vm_ops = {
+        .open           = blkdev_vm_open,
+        .close          = blkdev_vm_close,
+        .fault          = filemap_fault,
+        .map_pages      = filemap_map_pages,
+};
+static int blkdev_mmap(struct file *file, struct vm_area_struct *vma)
+{
+        struct inode *bd_inode = bdev_file_inode(file);
+        struct block_device *bdev = I_BDEV(bd_inode);
+        file_accessed(file);
+        mutex_lock(&bd_inode->i_mutex);
+        bdev->bd_map_count++;
+        if (IS_DAX(bd_inode)) {
+                vma->vm_ops = &blkdev_dax_vm_ops;
+                vma->vm_flags |= VM_MIXEDMAP | VM_HUGEPAGE;
+        } else {
+                vma->vm_ops = &blkdev_default_vm_ops;
+        }
+        mutex_unlock(&bd_inode->i_mutex);
+        return 0;
+}
+#else
+#define blkdev_mmap generic_file_mmap
+#endif
 const struct file_operations def_blk_fops = {
        .open           = blkdev_open,
        .release        = blkdev_close,
        .llseek         = block_llseek,
        .read_iter      = blkdev_read_iter,
        .write_iter     = blkdev_write_iter,
-        .mmap           = generic_file_mmap,
+        .mmap           = blkdev_mmap,
        .fsync          = blkdev_fsync,
        .unlocked_ioctl = block_ioctl,
 #ifdef CONFIG_COMPAT
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 6b66dd5d1540..a329f5ba35aa 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1831,11 +1831,11 @@ cifs_invalidate_mapping(struct inode *inode)
 * @word: long word containing the bit lock
 */
 static int
-cifs_wait_bit_killable(struct wait_bit_key *key)
+cifs_wait_bit_killable(struct wait_bit_key *key, int mode)
 {
-        if (fatal_signal_pending(current))
-                return -ERESTARTSYS;
        freezable_schedule_unsafe();
+        if (signal_pending_state(mode, current))
+                return -ERESTARTSYS;
        return 0;
 }
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 1c75a3a07f8f..602e8441bc0f 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -1175,6 +1175,7 @@ do_blockdev_direct_IO(struct kiocb *iocb, struct inode *inode,
                if (dio->flags & DIO_LOCKING)
                        mutex_unlock(&inode->i_mutex);
                kmem_cache_free(dio_cache, dio);
+                retval = 0;
                goto out;
        }
diff --git a/fs/exofs/inode.c b/fs/exofs/inode.c
index 73c64daa0f55..60f03b78914e 100644
--- a/fs/exofs/inode.c
+++ b/fs/exofs/inode.c
@@ -592,10 +592,7 @@ static struct page *__r4w_get_page(void *priv, u64 offset, bool *uptodate)
                        }
                        unlock_page(page);
                }
-                if (PageDirty(page) || PageWriteback(page))
+                *uptodate = PageUptodate(page);
-                        *uptodate = true;
-                else
-                        *uptodate = PageUptodate(page);
                EXOFS_DBGMSG2("index=0x%lx uptodate=%d\n", index, *uptodate);
                return page;
        } else {
diff --git a/fs/ext4/crypto.c b/fs/ext4/crypto.c
index af06830bfc00..1a0835073663 100644
--- a/fs/ext4/crypto.c
+++ b/fs/ext4/crypto.c
@@ -389,7 +389,7 @@ int ext4_encrypted_zeroout(struct inode *inode, struct ext4_extent *ex)
        struct ext4_crypto_ctx  *ctx;
        struct page             *ciphertext_page = NULL;
        struct bio              *bio;
-        ext4_lblk_t             lblk = ex->ee_block;
+        ext4_lblk_t             lblk = le32_to_cpu(ex->ee_block);
        ext4_fsblk_t            pblk = ext4_ext_pblock(ex);
        unsigned int            len = ext4_ext_get_actual_len(ex);
        int                     ret, err = 0;
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 750063f7a50c..cc7ca4e87144 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -26,6 +26,7 @@
 #include <linux/seqlock.h>
 #include <linux/mutex.h>
 #include <linux/timer.h>
+#include <linux/version.h>
 #include <linux/wait.h>
 #include <linux/blockgroup_lock.h>
 #include <linux/percpu_counter.h>
@@ -727,19 +728,55 @@ struct move_extent {
        <= (EXT4_GOOD_OLD_INODE_SIZE +                  \
            (einode)->i_extra_isize))                   \
+/*
+ * We use an encoding that preserves the times for extra epoch "00":
+ *
+ * extra  msb of                         adjust for signed
+ * epoch  32-bit                         32-bit tv_sec to
+ * bits   time    decoded 64-bit tv_sec  64-bit tv_sec      valid time range
+ * 0 0    1    -0x80000000..-0x00000001  0x000000000 1901-12-13..1969-12-31
+ * 0 0    0    0x000000000..0x07fffffff  0x000000000 1970-01-01..2038-01-19
+ * 0 1    1    0x080000000..0x0ffffffff  0x100000000 2038-01-19..2106-02-07
+ * 0 1    0    0x100000000..0x17fffffff  0x100000000 2106-02-07..2174-02-25
+ * 1 0    1    0x180000000..0x1ffffffff  0x200000000 2174-02-25..2242-03-16
+ * 1 0    0    0x200000000..0x27fffffff  0x200000000 2242-03-16..2310-04-04
+ * 1 1    1    0x280000000..0x2ffffffff  0x300000000 2310-04-04..2378-04-22
+ * 1 1    0    0x300000000..0x37fffffff  0x300000000 2378-04-22..2446-05-10
+ *
+ * Note that previous versions of the kernel on 64-bit systems would
+ * incorrectly use extra epoch bits 1,1 for dates between 1901 and
+ * 1970.  e2fsck will correct this, assuming that it is run on the
+ * affected filesystem before 2242.
+ */
 static inline __le32 ext4_encode_extra_time(struct timespec *time)
 {
-       return cpu_to_le32((sizeof(time->tv_sec) > 4 ?
+        u32 extra = sizeof(time->tv_sec) > 4 ?
-                           (time->tv_sec >> 32) & EXT4_EPOCH_MASK : 0) |
+                ((time->tv_sec - (s32)time->tv_sec) >> 32) & EXT4_EPOCH_MASK : 0;
-                          ((time->tv_nsec << EXT4_EPOCH_BITS) & EXT4_NSEC_MASK));
+        return cpu_to_le32(extra | (time->tv_nsec << EXT4_EPOCH_BITS));
 }
 static inline void ext4_decode_extra_time(struct timespec *time, __le32 extra)
 {
-       if (sizeof(time->tv_sec) > 4)
+        if (unlikely(sizeof(time->tv_sec) > 4 &&
-               time->tv_sec |= (__u64)(le32_to_cpu(extra) & EXT4_EPOCH_MASK)
+                        (extra & cpu_to_le32(EXT4_EPOCH_MASK)))) {
-                               << 32;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4,20,0)
-       time->tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> EXT4_EPOCH_BITS;
+                /* Handle legacy encoding of pre-1970 dates with epoch
+                 * bits 1,1.  We assume that by kernel version 4.20,
+                 * everyone will have run fsck over the affected
+                 * filesystems to correct the problem.  (This
+                 * backwards compatibility may be removed before this
+                 * time, at the discretion of the ext4 developers.)
+                 */
+                u64 extra_bits = le32_to_cpu(extra) & EXT4_EPOCH_MASK;
+                if (extra_bits == 3 && ((time->tv_sec) & 0x80000000) != 0)
+                        extra_bits = 0;
+                time->tv_sec += extra_bits << 32;
+#else
+                time->tv_sec += (u64)(le32_to_cpu(extra) & EXT4_EPOCH_MASK) << 32;
+#endif
+        }
+        time->tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> EXT4_EPOCH_BITS;
 }
 #define EXT4_INODE_SET_XTIME(xtime, inode, raw_inode)                          \
diff --git a/fs/ext4/symlink.c b/fs/ext4/symlink.c
index abe2401ce405..e8e7af62ac95 100644
--- a/fs/ext4/symlink.c
+++ b/fs/ext4/symlink.c
@@ -52,7 +52,7 @@ static const char *ext4_encrypted_follow_link(struct dentry *dentry, void **cook
        /* Symlink is encrypted */
        sd = (struct ext4_encrypted_symlink_data *)caddr;
        cstr.name = sd->encrypted_path;
-        cstr.len  = le32_to_cpu(sd->len);
+        cstr.len  = le16_to_cpu(sd->len);
        if ((cstr.len +
             sizeof(struct ext4_encrypted_symlink_data) - 1) >
            max_size) {
diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c
index 1b57c72f4a00..1420a3c614af 100644
--- a/fs/ext4/sysfs.c
+++ b/fs/ext4/sysfs.c
@@ -358,7 +358,7 @@ static int name##_open(struct inode *inode, struct file *file) \
        return single_open(file, ext4_seq_##name##_show, PDE_DATA(inode)); \
 } \
 \
-const struct file_operations ext4_seq_##name##_fops = { \
+static const struct file_operations ext4_seq_##name##_fops = { \
        .owner          = THIS_MODULE, \
        .open           = name##_open, \
        .read           = seq_read, \
diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
index eae2c11268bc..8e3ee1936c7e 100644
--- a/fs/fuse/cuse.c
+++ b/fs/fuse/cuse.c
@@ -549,6 +549,8 @@ static int cuse_channel_release(struct inode *inode, struct file *file)
                unregister_chrdev_region(cc->cdev->dev, 1);
                cdev_del(cc->cdev);
        }
+        /* Base reference is now owned by "fud" */
+        fuse_conn_put(&cc->fc);
        rc = fuse_dev_release(inode, file);     /* puts the base reference */
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index e0faf8f2c868..570ca4053c80 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1049,6 +1049,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
                tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes);
                flush_dcache_page(page);
+                iov_iter_advance(ii, tmp);
                if (!tmp) {
                        unlock_page(page);
                        page_cache_release(page);
@@ -1061,7 +1062,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
                req->page_descs[req->num_pages].length = tmp;
                req->num_pages++;
-                iov_iter_advance(ii, tmp);
                count += tmp;
                pos += tmp;
                offset += tmp;
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 89463eee6791..ca181e81c765 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1009,7 +1009,8 @@ out:
 }
 /* Fast check whether buffer is already attached to the required transaction */
-static bool jbd2_write_access_granted(handle_t *handle, struct buffer_head *bh)
+static bool jbd2_write_access_granted(handle_t *handle, struct buffer_head *bh,
+                                                        bool undo)
 {
        struct journal_head *jh;
        bool ret = false;
@@ -1036,6 +1037,9 @@ static bool jbd2_write_access_granted(handle_t *handle, struct buffer_head *bh)
        jh = READ_ONCE(bh->b_private);
        if (!jh)
                goto out;
+        /* For undo access buffer must have data copied */
+        if (undo && !jh->b_committed_data)
+                goto out;
        if (jh->b_transaction != handle->h_transaction &&
            jh->b_next_transaction != handle->h_transaction)
                goto out;
@@ -1073,7 +1077,7 @@ int jbd2_journal_get_write_access(handle_t *handle, struct buffer_head *bh)
        struct journal_head *jh;
        int rc;
-        if (jbd2_write_access_granted(handle, bh))
+        if (jbd2_write_access_granted(handle, bh, false))
                return 0;
        jh = jbd2_journal_add_journal_head(bh);
@@ -1210,7 +1214,7 @@ int jbd2_journal_get_undo_access(handle_t *handle, struct buffer_head *bh)
        char *committed_data = NULL;
        JBUFFER_TRACE(jh, "entry");
-        if (jbd2_write_access_granted(handle, bh))
+        if (jbd2_write_access_granted(handle, bh, true))
                return 0;
        jh = jbd2_journal_add_journal_head(bh);
@@ -2152,6 +2156,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,
                if (!buffer_dirty(bh)) {
                        /* bdflush has written it.  We can drop it now */
+                        __jbd2_journal_remove_checkpoint(jh);
                        goto zap_buffer;
                }
@@ -2181,6 +2186,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,
                                /* The orphan record's transaction has
                                 * committed.  We can cleanse this buffer */
                                clear_buffer_jbddirty(bh);
+                                __jbd2_journal_remove_checkpoint(jh);
                                goto zap_buffer;
                        }
                }
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index beac58b0e09c..646cdac73488 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -78,8 +78,7 @@ static __be32 *read_buf(struct xdr_stream *xdr, int nbytes)
        p = xdr_inline_decode(xdr, nbytes);
        if (unlikely(p == NULL))
-                printk(KERN_WARNING "NFS: NFSv4 callback reply buffer overflowed "
+                printk(KERN_WARNING "NFS: NFSv4 callback reply buffer overflowed!\n");
-                                                        "or truncated request.\n");
        return p;
 }
@@ -890,7 +889,6 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
        struct cb_compound_hdr_arg hdr_arg = { 0 };
        struct cb_compound_hdr_res hdr_res = { NULL };
        struct xdr_stream xdr_in, xdr_out;
-        struct xdr_buf *rq_arg = &rqstp->rq_arg;
        __be32 *p, status;
        struct cb_process_state cps = {
                .drc_status = 0,
@@ -902,8 +900,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
        dprintk("%s: start\n", __func__);
-        rq_arg->len = rq_arg->head[0].iov_len + rq_arg->page_len;
+        xdr_init_decode(&xdr_in, &rqstp->rq_arg, rqstp->rq_arg.head[0].iov_base);
-        xdr_init_decode(&xdr_in, rq_arg, rq_arg->head[0].iov_base);
        p = (__be32*)((char *)rqstp->rq_res.head[0].iov_base + rqstp->rq_res.head[0].iov_len);
        xdr_init_encode(&xdr_out, &rqstp->rq_res, p);
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 31b0a52223a7..c7e8b87da5b2 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -75,11 +75,11 @@ nfs_fattr_to_ino_t(struct nfs_fattr *fattr)
 * nfs_wait_bit_killable - helper for functions that are sleeping on bit locks
 * @word: long word containing the bit lock
 */
-int nfs_wait_bit_killable(struct wait_bit_key *key)
+int nfs_wait_bit_killable(struct wait_bit_key *key, int mode)
 {
-        if (fatal_signal_pending(current))
-                return -ERESTARTSYS;
        freezable_schedule_unsafe();
+        if (signal_pending_state(mode, current))
+                return -ERESTARTSYS;
        return 0;
 }
 EXPORT_SYMBOL_GPL(nfs_wait_bit_killable);
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 56cfde26fb9c..9dea85f7f918 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -379,7 +379,7 @@ extern int nfs_drop_inode(struct inode *);
 extern void nfs_clear_inode(struct inode *);
 extern void nfs_evict_inode(struct inode *);
 void nfs_zap_acl_cache(struct inode *inode);
-extern int nfs_wait_bit_killable(struct wait_bit_key *key);
+extern int nfs_wait_bit_killable(struct wait_bit_key *key, int mode);
 /* super.c */
 extern const struct super_operations nfs_sops;
diff --git a/fs/nfs/objlayout/objio_osd.c b/fs/nfs/objlayout/objio_osd.c
index 5c0c6b58157f..9aebffb40505 100644
--- a/fs/nfs/objlayout/objio_osd.c
+++ b/fs/nfs/objlayout/objio_osd.c
@@ -476,10 +476,7 @@ static struct page *__r4w_get_page(void *priv, u64 offset, bool *uptodate)
                }
                unlock_page(page);
        }
-        if (PageDirty(page) || PageWriteback(page))
+        *uptodate = PageUptodate(page);
-                *uptodate = true;
-        else
-                *uptodate = PageUptodate(page);
        dprintk("%s: index=0x%lx uptodate=%d\n", __func__, index, *uptodate);
        return page;
 }
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index fe3ddd20ff89..452a011ba0d8 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -129,7 +129,7 @@ __nfs_iocounter_wait(struct nfs_io_counter *c)
                set_bit(NFS_IO_INPROGRESS, &c->flags);
                if (atomic_read(&c->io_count) == 0)
                        break;
-                ret = nfs_wait_bit_killable(&q.key);
+                ret = nfs_wait_bit_killable(&q.key, TASK_KILLABLE);
        } while (atomic_read(&c->io_count) != 0 && !ret);
        finish_wait(wq, &q.wait);
        return ret;
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 5a8ae2125b50..bec0384499f7 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1466,11 +1466,11 @@ static bool pnfs_within_mdsthreshold(struct nfs_open_context *ctx,
 }
 /* stop waiting if someone clears NFS_LAYOUT_RETRY_LAYOUTGET bit. */
-static int pnfs_layoutget_retry_bit_wait(struct wait_bit_key *key)
+static int pnfs_layoutget_retry_bit_wait(struct wait_bit_key *key, int mode)
 {
        if (!test_bit(NFS_LAYOUT_RETRY_LAYOUTGET, key->flags))
                return 1;
-        return nfs_wait_bit_killable(key);
+        return nfs_wait_bit_killable(key, mode);
 }
 static bool pnfs_prepare_to_retry_layoutget(struct pnfs_layout_hdr *lo)
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index a03f6f433075..3123408da935 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -367,13 +367,11 @@ static int ocfs2_mknod(struct inode *dir,
                goto leave;
        }
-        status = posix_acl_create(dir, &mode, &default_acl, &acl);
+        status = posix_acl_create(dir, &inode->i_mode, &default_acl, &acl);
        if (status) {
                mlog_errno(status);
                goto leave;
        }
-        /* update inode->i_mode after mask with "umask". */
-        inode->i_mode = mode;
        handle = ocfs2_start_trans(osb, ocfs2_mknod_credits(osb->sb,
                                                            S_ISDIR(mode),
diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
index db284bff29dc..9dbb739cafa0 100644
--- a/include/asm-generic/tlb.h
+++ b/include/asm-generic/tlb.h
@@ -5,7 +5,7 @@
 * Copyright 2001 Red Hat, Inc.
 * Based on code from mm/memory.c Copyright Linus Torvalds and others.
 *
- * Copyright 2011 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ * Copyright 2011 Red Hat, Inc., Peter Zijlstra
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
diff --git a/include/linux/badblocks.h b/include/linux/badblocks.h
new file mode 100644
index 000000000000..c3bdf8c59480
--- /dev/null
+++ b/include/linux/badblocks.h
@@ -0,0 +1,65 @@
+#ifndef _LINUX_BADBLOCKS_H
+#define _LINUX_BADBLOCKS_H
+#include <linux/seqlock.h>
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/stddef.h>
+#include <linux/types.h>
+#define BB_LEN_MASK     (0x00000000000001FFULL)
+#define BB_OFFSET_MASK  (0x7FFFFFFFFFFFFE00ULL)
+#define BB_ACK_MASK     (0x8000000000000000ULL)
+#define BB_MAX_LEN      512
+#define BB_OFFSET(x)    (((x) & BB_OFFSET_MASK) >> 9)
+#define BB_LEN(x)       (((x) & BB_LEN_MASK) + 1)
+#define BB_ACK(x)       (!!((x) & BB_ACK_MASK))
+#define BB_MAKE(a, l, ack) (((a)<<9) | ((l)-1) | ((u64)(!!(ack)) << 63))
+/* Bad block numbers are stored sorted in a single page.
+ * 64bits is used for each block or extent.
+ * 54 bits are sector number, 9 bits are extent size,
+ * 1 bit is an 'acknowledged' flag.
+ */
+#define MAX_BADBLOCKS   (PAGE_SIZE/8)
+struct badblocks {
+        struct device *dev;     /* set by devm_init_badblocks */
+        int count;              /* count of bad blocks */
+        int unacked_exist;      /* there probably are unacknowledged
+                                 * bad blocks.  This is only cleared
+                                 * when a read discovers none
+                                 */
+        int shift;              /* shift from sectors to block size
+                                 * a -ve shift means badblocks are
+                                 * disabled.*/
+        u64 *page;              /* badblock list */
+        int changed;
+        seqlock_t lock;
+        sector_t sector;
+        sector_t size;          /* in sectors */
+};
+int badblocks_check(struct badblocks *bb, sector_t s, int sectors,
+                   sector_t *first_bad, int *bad_sectors);
+int badblocks_set(struct badblocks *bb, sector_t s, int sectors,
+                        int acknowledged);
+int badblocks_clear(struct badblocks *bb, sector_t s, int sectors);
+void ack_all_badblocks(struct badblocks *bb);
+ssize_t badblocks_show(struct badblocks *bb, char *page, int unack);
+ssize_t badblocks_store(struct badblocks *bb, const char *page, size_t len,
+                        int unack);
+int badblocks_init(struct badblocks *bb, int enable);
+void badblocks_exit(struct badblocks *bb);
+struct device;
+int devm_init_badblocks(struct device *dev, struct badblocks *bb);
+static inline void devm_exit_badblocks(struct device *dev, struct badblocks *bb)
+{
+        if (bb->dev != dev) {
+                dev_WARN_ONCE(dev, 1, "%s: badblocks instance not associated\n",
+                                __func__);
+                return;
+        }
+        badblocks_exit(bb);
+}
+#endif
diff --git a/include/linux/bitops.h b/include/linux/bitops.h
index 2b8ed123ad36..defeaac0745f 100644
--- a/include/linux/bitops.h
+++ b/include/linux/bitops.h
@@ -107,7 +107,7 @@ static inline __u64 ror64(__u64 word, unsigned int shift)
 */
 static inline __u32 rol32(__u32 word, unsigned int shift)
 {
-        return (word << shift) | (word >> (32 - shift));
+        return (word << shift) | (word >> ((-shift) & 31));
 }
 /**
diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
index 60d44b26276d..06b77f9dd3f2 100644
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -90,7 +90,6 @@ enum {
 */
 struct cgroup_file {
        /* do not access any fields from outside cgroup core */
-        struct list_head node;                  /* anchored at css->files */
        struct kernfs_node *kn;
 };
@@ -134,9 +133,6 @@ struct cgroup_subsys_state {
         */
        u64 serial_nr;
-        /* all cgroup_files associated with this css */
-        struct list_head files;
        /* percpu_ref killing and RCU release */
        struct rcu_head rcu_head;
        struct work_struct destroy_work;
@@ -426,12 +422,9 @@ struct cgroup_subsys {
        void (*css_reset)(struct cgroup_subsys_state *css);
        void (*css_e_css_changed)(struct cgroup_subsys_state *css);
-        int (*can_attach)(struct cgroup_subsys_state *css,
+        int (*can_attach)(struct cgroup_taskset *tset);
-                          struct cgroup_taskset *tset);
+        void (*cancel_attach)(struct cgroup_taskset *tset);
-        void (*cancel_attach)(struct cgroup_subsys_state *css,
+        void (*attach)(struct cgroup_taskset *tset);
-                              struct cgroup_taskset *tset);
-        void (*attach)(struct cgroup_subsys_state *css,
-                       struct cgroup_taskset *tset);
        int (*can_fork)(struct task_struct *task, void **priv_p);
        void (*cancel_fork)(struct task_struct *task, void *priv);
        void (*fork)(struct task_struct *task, void *priv);
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index 22e3754f89c5..cb91b44f5f78 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -88,6 +88,7 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from);
 int cgroup_add_dfl_cftypes(struct cgroup_subsys *ss, struct cftype *cfts);
 int cgroup_add_legacy_cftypes(struct cgroup_subsys *ss, struct cftype *cfts);
 int cgroup_rm_cftypes(struct cftype *cfts);
+void cgroup_file_notify(struct cgroup_file *cfile);
 char *task_cgroup_path(struct task_struct *task, char *buf, size_t buflen);
 int cgroupstats_build(struct cgroupstats *stats, struct dentry *dentry);
@@ -119,8 +120,10 @@ struct cgroup_subsys_state *css_rightmost_descendant(struct cgroup_subsys_state
 struct cgroup_subsys_state *css_next_descendant_post(struct cgroup_subsys_state *pos,
                                                     struct cgroup_subsys_state *css);
-struct task_struct *cgroup_taskset_first(struct cgroup_taskset *tset);
+struct task_struct *cgroup_taskset_first(struct cgroup_taskset *tset,
-struct task_struct *cgroup_taskset_next(struct cgroup_taskset *tset);
+                                         struct cgroup_subsys_state **dst_cssp);
+struct task_struct *cgroup_taskset_next(struct cgroup_taskset *tset,
+                                        struct cgroup_subsys_state **dst_cssp);
 void css_task_iter_start(struct cgroup_subsys_state *css,
                         struct css_task_iter *it);
@@ -235,30 +238,39 @@ void css_task_iter_end(struct css_task_iter *it);
 /**
 * cgroup_taskset_for_each - iterate cgroup_taskset
 * @task: the loop cursor
+ * @dst_css: the destination css
 * @tset: taskset to iterate
 *
 * @tset may contain multiple tasks and they may belong to multiple
- * processes.  When there are multiple tasks in @tset, if a task of a
+ * processes.
- * process is in @tset, all tasks of the process are in @tset.  Also, all
+ *
- * are guaranteed to share the same source and destination csses.
+ * On the v2 hierarchy, there may be tasks from multiple processes and they
+ * may not share the source or destination csses.
+ *
+ * On traditional hierarchies, when there are multiple tasks in @tset, if a
+ * task of a process is in @tset, all tasks of the process are in @tset.
+ * Also, all are guaranteed to share the same source and destination csses.
 *
 * Iteration is not in any specific order.
 */
-#define cgroup_taskset_for_each(task, tset)                             \
+#define cgroup_taskset_for_each(task, dst_css, tset)                    \
-        for ((task) = cgroup_taskset_first((tset)); (task);             \
+        for ((task) = cgroup_taskset_first((tset), &(dst_css));         \
-             (task) = cgroup_taskset_next((tset)))
+             (task);                                                    \
+             (task) = cgroup_taskset_next((tset), &(dst_css)))
 /**
 * cgroup_taskset_for_each_leader - iterate group leaders in a cgroup_taskset
 * @leader: the loop cursor
+ * @dst_css: the destination css
 * @tset: takset to iterate
 *
 * Iterate threadgroup leaders of @tset.  For single-task migrations, @tset
 * may not contain any.
 */
-#define cgroup_taskset_for_each_leader(leader, tset)                    \
+#define cgroup_taskset_for_each_leader(leader, dst_css, tset)           \
-        for ((leader) = cgroup_taskset_first((tset)); (leader);         \
+        for ((leader) = cgroup_taskset_first((tset), &(dst_css));       \
-             (leader) = cgroup_taskset_next((tset)))                    \
+             (leader);                                                  \
+             (leader) = cgroup_taskset_next((tset), &(dst_css)))        \
                if ((leader) != (leader)->group_leader)                 \
                        ;                                               \
                else
@@ -516,19 +528,6 @@ static inline void pr_cont_cgroup_path(struct cgroup *cgrp)
        pr_cont_kernfs_path(cgrp->kn);
 }
-/**
- * cgroup_file_notify - generate a file modified event for a cgroup_file
- * @cfile: target cgroup_file
- *
- * @cfile must have been obtained by setting cftype->file_offset.
- */
-static inline void cgroup_file_notify(struct cgroup_file *cfile)
-{
-        /* might not have been created due to one of the CFTYPE selector flags */
-        if (cfile->kn)
-                kernfs_notify(cfile->kn);
-}
 #else /* !CONFIG_CGROUPS */
 struct cgroup_subsys_state;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 3aa514254161..96fabc93b583 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -482,6 +482,9 @@ struct block_device {
        int                     bd_fsfreeze_count;
        /* Mutex for freeze */
        struct mutex            bd_fsfreeze_mutex;
+#ifdef CONFIG_FS_DAX
+        int                     bd_map_count;
+#endif
 };
 /*
@@ -2264,6 +2267,14 @@ extern struct super_block *freeze_bdev(struct block_device *);
 extern void emergency_thaw_all(void);
 extern int thaw_bdev(struct block_device *bdev, struct super_block *sb);
 extern int fsync_bdev(struct block_device *);
+#ifdef CONFIG_FS_DAX
+extern bool blkdev_dax_capable(struct block_device *bdev);
+#else
+static inline bool blkdev_dax_capable(struct block_device *bdev)
+{
+        return false;
+}
+#endif
 extern struct super_block *blockdev_superblock;
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index 847cc1d91634..5c706765404a 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -162,6 +162,7 @@ struct disk_part_tbl {
 };
 struct disk_events;
+struct badblocks;
 #if defined(CONFIG_BLK_DEV_INTEGRITY)
@@ -213,6 +214,7 @@ struct gendisk {
        struct kobject integrity_kobj;
 #endif  /* CONFIG_BLK_DEV_INTEGRITY */
        int node_id;
+        struct badblocks *bb;
 };
 static inline struct gendisk *part_to_disk(struct hd_struct *part)
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index c9ae0c6ec050..d5d798b35c1f 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -330,6 +330,7 @@ struct rdists {
 };
 struct irq_domain;
+struct device_node;
 int its_cpu_init(void);
 int its_init(struct device_node *node, struct rdists *rdists,
             struct irq_domain *domain);
diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
index 8dde55974f18..0536524bb9eb 100644
--- a/include/linux/jump_label.h
+++ b/include/linux/jump_label.h
@@ -5,7 +5,7 @@
 * Jump label support
 *
 * Copyright (C) 2009-2012 Jason Baron <jbaron@redhat.com>
- * Copyright (C) 2011-2012 Peter Zijlstra <pzijlstr@redhat.com>
+ * Copyright (C) 2011-2012 Red Hat, Inc., Peter Zijlstra
 *
 * DEPRECATED API:
 *
diff --git a/include/linux/kmemleak.h b/include/linux/kmemleak.h
index d0a1f99e24e3..4894c6888bc6 100644
--- a/include/linux/kmemleak.h
+++ b/include/linux/kmemleak.h
@@ -25,7 +25,7 @@
 #ifdef CONFIG_DEBUG_KMEMLEAK
-extern void kmemleak_init(void) __ref;
+extern void kmemleak_init(void) __init;
 extern void kmemleak_alloc(const void *ptr, size_t size, int min_count,
                           gfp_t gfp) __ref;
 extern void kmemleak_alloc_percpu(const void __percpu *ptr, size_t size,
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 83577f8fd15b..600c1e0626a5 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -210,6 +210,7 @@ enum {
        ATA_FLAG_SLAVE_POSS     = (1 << 0), /* host supports slave dev */
                                            /* (doesn't imply presence) */
        ATA_FLAG_SATA           = (1 << 1),
+        ATA_FLAG_NO_LOG_PAGE    = (1 << 5), /* do not issue log page read */
        ATA_FLAG_NO_ATAPI       = (1 << 6), /* No ATAPI support */
        ATA_FLAG_PIO_DMA        = (1 << 7), /* PIO cmds via DMA */
        ATA_FLAG_PIO_LBA48      = (1 << 8), /* Host DMA engine is LBA28 only */
diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h
index 3f021dc5da8c..bed40dff0e86 100644
--- a/include/linux/libnvdimm.h
+++ b/include/linux/libnvdimm.h
@@ -116,6 +116,7 @@ static inline struct nd_blk_region_desc *to_blk_region_desc(
 }
+int nvdimm_bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length);
 struct nvdimm_bus *__nvdimm_bus_register(struct device *parent,
                struct nvdimm_bus_descriptor *nfit_desc, struct module *module);
 #define nvdimm_bus_register(parent, desc) \
diff --git a/include/linux/lightnvm.h b/include/linux/lightnvm.h
index c6916aec43b6..034117b3be5f 100644
--- a/include/linux/lightnvm.h
+++ b/include/linux/lightnvm.h
@@ -50,9 +50,16 @@ enum {
        NVM_IO_DUAL_ACCESS      = 0x1,
        NVM_IO_QUAD_ACCESS      = 0x2,
+        /* NAND Access Modes */
        NVM_IO_SUSPEND          = 0x80,
        NVM_IO_SLC_MODE         = 0x100,
        NVM_IO_SCRAMBLE_DISABLE = 0x200,
+        /* Block Types */
+        NVM_BLK_T_FREE          = 0x0,
+        NVM_BLK_T_BAD           = 0x1,
+        NVM_BLK_T_DEV           = 0x2,
+        NVM_BLK_T_HOST          = 0x4,
 };
 struct nvm_id_group {
@@ -176,17 +183,17 @@ struct nvm_block;
 typedef int (nvm_l2p_update_fn)(u64, u32, __le64 *, void *);
 typedef int (nvm_bb_update_fn)(struct ppa_addr, int, u8 *, void *);
-typedef int (nvm_id_fn)(struct request_queue *, struct nvm_id *);
+typedef int (nvm_id_fn)(struct nvm_dev *, struct nvm_id *);
-typedef int (nvm_get_l2p_tbl_fn)(struct request_queue *, u64, u32,
+typedef int (nvm_get_l2p_tbl_fn)(struct nvm_dev *, u64, u32,
                                nvm_l2p_update_fn *, void *);
 typedef int (nvm_op_bb_tbl_fn)(struct nvm_dev *, struct ppa_addr, int,
                                nvm_bb_update_fn *, void *);
-typedef int (nvm_op_set_bb_fn)(struct request_queue *, struct nvm_rq *, int);
+typedef int (nvm_op_set_bb_fn)(struct nvm_dev *, struct nvm_rq *, int);
-typedef int (nvm_submit_io_fn)(struct request_queue *, struct nvm_rq *);
+typedef int (nvm_submit_io_fn)(struct nvm_dev *, struct nvm_rq *);
-typedef int (nvm_erase_blk_fn)(struct request_queue *, struct nvm_rq *);
+typedef int (nvm_erase_blk_fn)(struct nvm_dev *, struct nvm_rq *);
-typedef void *(nvm_create_dma_pool_fn)(struct request_queue *, char *);
+typedef void *(nvm_create_dma_pool_fn)(struct nvm_dev *, char *);
 typedef void (nvm_destroy_dma_pool_fn)(void *);
-typedef void *(nvm_dev_dma_alloc_fn)(struct request_queue *, void *, gfp_t,
+typedef void *(nvm_dev_dma_alloc_fn)(struct nvm_dev *, void *, gfp_t,
                                                                dma_addr_t *);
 typedef void (nvm_dev_dma_free_fn)(void *, void*, dma_addr_t);
diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h
index 70400dc7660f..c57e424d914b 100644
--- a/include/linux/lockdep.h
+++ b/include/linux/lockdep.h
@@ -2,7 +2,7 @@
 * Runtime locking correctness validator
 *
 *  Copyright (C) 2006,2007 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
- *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra
 *
 * see Documentation/locking/lockdep-design.txt for more details.
 */
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 7501626ab529..d3133be12d92 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -427,6 +427,17 @@ enum {
 };
 enum {
+        /*
+         * Max wqe size for rdma read is 512 bytes, so this
+         * limits our max_sge_rd as the wqe needs to fit:
+         * - ctrl segment (16 bytes)
+         * - rdma segment (16 bytes)
+         * - scatter elements (16 bytes each)
+         */
+        MLX4_MAX_SGE_RD = (512 - 16 - 16) / 16
+};
+enum {
        MLX4_DEV_PMC_SUBTYPE_GUID_INFO   = 0x14,
        MLX4_DEV_PMC_SUBTYPE_PORT_INFO   = 0x15,
        MLX4_DEV_PMC_SUBTYPE_PKEY_TABLE  = 0x16,
diff --git a/include/linux/of_irq.h b/include/linux/of_irq.h
index 039f2eec49ce..1e0deb8e8494 100644
--- a/include/linux/of_irq.h
+++ b/include/linux/of_irq.h
@@ -46,12 +46,14 @@ extern int of_irq_get(struct device_node *dev, int index);
 extern int of_irq_get_byname(struct device_node *dev, const char *name);
 extern int of_irq_to_resource_table(struct device_node *dev,
                struct resource *res, int nr_irqs);
+extern struct device_node *of_irq_find_parent(struct device_node *child);
 extern struct irq_domain *of_msi_get_domain(struct device *dev,
                                            struct device_node *np,
                                            enum irq_domain_bus_token token);
 extern struct irq_domain *of_msi_map_get_device_domain(struct device *dev,
                                                       u32 rid);
 extern void of_msi_configure(struct device *dev, struct device_node *np);
+u32 of_msi_map_rid(struct device *dev, struct device_node *msi_np, u32 rid_in);
 #else
 static inline int of_irq_count(struct device_node *dev)
 {
@@ -70,6 +72,11 @@ static inline int of_irq_to_resource_table(struct device_node *dev,
 {
        return 0;
 }
+static inline void *of_irq_find_parent(struct device_node *child)
+{
+        return NULL;
+}
 static inline struct irq_domain *of_msi_get_domain(struct device *dev,
                                                   struct device_node *np,
                                                   enum irq_domain_bus_token token)
@@ -84,6 +91,11 @@ static inline struct irq_domain *of_msi_map_get_device_domain(struct device *dev
 static inline void of_msi_configure(struct device *dev, struct device_node *np)
 {
 }
+static inline u32 of_msi_map_rid(struct device *dev,
+                                 struct device_node *msi_np, u32 rid_in)
+{
+        return rid_in;
+}
 #endif
 #if defined(CONFIG_OF_IRQ) || defined(CONFIG_SPARC)
@@ -93,7 +105,6 @@ static inline void of_msi_configure(struct device *dev, struct device_node *np)
 * so declare it here regardless of the CONFIG_OF_IRQ setting.
 */
 extern unsigned int irq_of_parse_and_map(struct device_node *node, int index);
-u32 of_msi_map_rid(struct device *dev, struct device_node *msi_np, u32 rid_in);
 #else /* !CONFIG_OF && !CONFIG_SPARC */
 static inline unsigned int irq_of_parse_and_map(struct device_node *dev,
@@ -101,12 +112,6 @@ static inline unsigned int irq_of_parse_and_map(struct device_node *dev,
 {
        return 0;
 }
-static inline u32 of_msi_map_rid(struct device *dev,
-                                 struct device_node *msi_np, u32 rid_in)
-{
-        return rid_in;
-}
 #endif /* !CONFIG_OF */
 #endif /* __OF_IRQ_H */
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index d841d33bcdc9..f9828a48f16a 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -697,9 +697,11 @@ struct perf_cgroup {
 * if there is no cgroup event for the current CPU context.
 */
 static inline struct perf_cgroup *
-perf_cgroup_from_task(struct task_struct *task)
+perf_cgroup_from_task(struct task_struct *task, struct perf_event_context *ctx)
 {
-        return container_of(task_css(task, perf_event_cgrp_id),
+        return container_of(task_css_check(task, perf_event_cgrp_id,
+                                           ctx ? lockdep_is_held(&ctx->lock)
+                                               : true),
                            struct perf_cgroup, css);
 }
 #endif /* CONFIG_CGROUP_PERF */
diff --git a/include/linux/proportions.h b/include/linux/proportions.h
index 5440f64d2942..21221338ad18 100644
--- a/include/linux/proportions.h
+++ b/include/linux/proportions.h
@@ -1,7 +1,7 @@
 /*
 * FLoating proportions
 *
- *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra
 *
 * This file contains the public data structure and API definitions.
 */
diff --git a/include/linux/stop_machine.h b/include/linux/stop_machine.h
index 0adedca24c5b..0e1b1540597a 100644
--- a/include/linux/stop_machine.h
+++ b/include/linux/stop_machine.h
@@ -99,7 +99,7 @@ static inline int try_stop_cpus(const struct cpumask *cpumask,
 * grabbing every spinlock (and more).  So the "read" side to such a
 * lock is anything which disables preemption.
 */
-#if defined(CONFIG_STOP_MACHINE) && defined(CONFIG_SMP)
+#if defined(CONFIG_SMP) || defined(CONFIG_HOTPLUG_CPU)
 /**
 * stop_machine: freeze the machine on all CPUs and run this function
@@ -118,7 +118,7 @@ int stop_machine(cpu_stop_fn_t fn, void *data, const struct cpumask *cpus);
 int stop_machine_from_inactive_cpu(cpu_stop_fn_t fn, void *data,
                                   const struct cpumask *cpus);
-#else    /* CONFIG_STOP_MACHINE && CONFIG_SMP */
+#else   /* CONFIG_SMP || CONFIG_HOTPLUG_CPU */
 static inline int stop_machine(cpu_stop_fn_t fn, void *data,
                                 const struct cpumask *cpus)
@@ -137,5 +137,5 @@ static inline int stop_machine_from_inactive_cpu(cpu_stop_fn_t fn, void *data,
        return stop_machine(fn, data, cpus);
 }
-#endif  /* CONFIG_STOP_MACHINE && CONFIG_SMP */
+#endif  /* CONFIG_SMP || CONFIG_HOTPLUG_CPU */
 #endif  /* _LINUX_STOP_MACHINE */
diff --git a/include/linux/uprobes.h b/include/linux/uprobes.h
index 0bdc72f36905..4a29c75b146e 100644
--- a/include/linux/uprobes.h
+++ b/include/linux/uprobes.h
@@ -21,7 +21,7 @@
 * Authors:
 *      Srikar Dronamraju
 *      Jim Keniston
- * Copyright (C) 2011-2012 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ * Copyright (C) 2011-2012 Red Hat, Inc., Peter Zijlstra
 */
 #include <linux/errno.h>
diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
index 9948c874e3f1..1d0043dc34e4 100644
--- a/include/linux/usb/quirks.h
+++ b/include/linux/usb/quirks.h
@@ -47,4 +47,7 @@
 /* device generates spurious wakeup, ignore remote wakeup capability */
 #define USB_QUIRK_IGNORE_REMOTE_WAKEUP          BIT(9)
+/* device can't handle Link Power Management */
+#define USB_QUIRK_NO_LPM                        BIT(10)
 #endif /* __LINUX_USB_QUIRKS_H */
diff --git a/include/linux/vfio.h b/include/linux/vfio.h
index 610a86a892b8..ddb440975382 100644
--- a/include/linux/vfio.h
+++ b/include/linux/vfio.h
@@ -44,9 +44,6 @@ struct vfio_device_ops {
        void    (*request)(void *device_data, unsigned int count);
 };
-extern struct iommu_group *vfio_iommu_group_get(struct device *dev);
-extern void vfio_iommu_group_put(struct iommu_group *group, struct device *dev);
 extern int vfio_add_group_dev(struct device *dev,
                              const struct vfio_device_ops *ops,
                              void *device_data);
diff --git a/include/linux/wait.h b/include/linux/wait.h
index 1e1bf9f963a9..513b36f04dfd 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -145,7 +145,7 @@ __remove_wait_queue(wait_queue_head_t *head, wait_queue_t *old)
        list_del(&old->task_list);
 }
-typedef int wait_bit_action_f(struct wait_bit_key *);
+typedef int wait_bit_action_f(struct wait_bit_key *, int mode);
 void __wake_up(wait_queue_head_t *q, unsigned int mode, int nr, void *key);
 void __wake_up_locked_key(wait_queue_head_t *q, unsigned int mode, void *key);
 void __wake_up_sync_key(wait_queue_head_t *q, unsigned int mode, int nr, void *key);
@@ -960,10 +960,10 @@ int wake_bit_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
        } while (0)
-extern int bit_wait(struct wait_bit_key *);
+extern int bit_wait(struct wait_bit_key *, int);
-extern int bit_wait_io(struct wait_bit_key *);
+extern int bit_wait_io(struct wait_bit_key *, int);
-extern int bit_wait_timeout(struct wait_bit_key *);
+extern int bit_wait_timeout(struct wait_bit_key *, int);
-extern int bit_wait_io_timeout(struct wait_bit_key *);
+extern int bit_wait_io_timeout(struct wait_bit_key *, int);
 /**
 * wait_on_bit - wait for a bit to be cleared
diff --git a/include/rdma/ib_mad.h b/include/rdma/ib_mad.h
index 188df91d5851..ec9b44dd3d80 100644
--- a/include/rdma/ib_mad.h
+++ b/include/rdma/ib_mad.h
@@ -237,6 +237,8 @@ struct ib_vendor_mad {
        u8                      data[IB_MGMT_VENDOR_DATA];
 };
+#define IB_MGMT_CLASSPORTINFO_ATTR_ID   cpu_to_be16(0x0001)
 struct ib_class_port_info {
        u8                      base_version;
        u8                      class_version;
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 9a68a19532ba..120da1d7f57e 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1271,6 +1271,7 @@ struct ib_uobject {
        int                     id;             /* index into kernel idr */
        struct kref             ref;
        struct rw_semaphore     mutex;          /* protects .live */
+        struct rcu_head         rcu;            /* kfree_rcu() overhead */
        int                     live;
 };
diff --git a/include/sound/hda_register.h b/include/sound/hda_register.h
index 2ae8812d7b1a..94dc6a9772e0 100644
--- a/include/sound/hda_register.h
+++ b/include/sound/hda_register.h
@@ -93,6 +93,9 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
 #define AZX_REG_HSW_EM4                 0x100c
 #define AZX_REG_HSW_EM5                 0x1010
+/* Skylake/Broxton display HD-A controller Extended Mode registers */
+#define AZX_REG_SKL_EM4L                0x1040
 /* PCI space */
 #define AZX_PCIREG_TCSEL                0x44
diff --git a/include/uapi/linux/fs.h b/include/uapi/linux/fs.h
index f15d980249b5..401c409e9239 100644
--- a/include/uapi/linux/fs.h
+++ b/include/uapi/linux/fs.h
@@ -152,6 +152,8 @@ struct inodes_stat_t {
 #define BLKSECDISCARD _IO(0x12,125)
 #define BLKROTATIONAL _IO(0x12,126)
 #define BLKZEROOUT _IO(0x12,127)
+#define BLKDAXSET _IO(0x12,128)
+#define BLKDAXGET _IO(0x12,129)
 #define BMAP_IOCTL 1            /* obsolete - kept for compatibility */
 #define FIBMAP     _IO(0x00,1)  /* bmap access */
diff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h
index 751b69f858c8..9fd7b5d8df2f 100644
--- a/include/uapi/linux/vfio.h
+++ b/include/uapi/linux/vfio.h
@@ -39,13 +39,6 @@
 #define VFIO_SPAPR_TCE_v2_IOMMU         7
 /*
- * The No-IOMMU IOMMU offers no translation or isolation for devices and
- * supports no ioctls outside of VFIO_CHECK_EXTENSION.  Use of VFIO's No-IOMMU
- * code will taint the host kernel and should be used with extreme caution.
- */
-#define VFIO_NOIOMMU_IOMMU              8
-/*
 * The IOCTL interface is designed for extensibility by embedding the
 * structure length (argsz) and flags into structures passed between
 * kernel and userspace.  We therefore use the _IO() macro for these
diff --git a/init/Kconfig b/init/Kconfig
index c24b6f767bf0..235c7a2c0d20 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -2030,13 +2030,6 @@ config INIT_ALL_POSSIBLE
          it was better to provide this option than to break all the archs
          and have several arch maintainers pursuing me down dark alleys.
-config STOP_MACHINE
-        bool
-        default y
-        depends on (SMP && MODULE_UNLOAD) || HOTPLUG_CPU
-        help
-          Need stop_machine() primitive.
 source "block/Kconfig"
 config PREEMPT_NOTIFIERS
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index f1603c153890..470f6536b9e8 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -98,6 +98,12 @@ static DEFINE_SPINLOCK(css_set_lock);
 static DEFINE_SPINLOCK(cgroup_idr_lock);
 /*
+ * Protects cgroup_file->kn for !self csses.  It synchronizes notifications
+ * against file removal/re-creation across css hiding.
+ */
+static DEFINE_SPINLOCK(cgroup_file_kn_lock);
+/*
 * Protects cgroup_subsys->release_agent_path.  Modifying it also requires
 * cgroup_mutex.  Reading requires either cgroup_mutex or this spinlock.
 */
@@ -754,9 +760,11 @@ static void put_css_set_locked(struct css_set *cset)
        if (!atomic_dec_and_test(&cset->refcount))
                return;
-        /* This css_set is dead. unlink it and release cgroup refcounts */
+        /* This css_set is dead. unlink it and release cgroup and css refs */
-        for_each_subsys(ss, ssid)
+        for_each_subsys(ss, ssid) {
                list_del(&cset->e_cset_node[ssid]);
+                css_put(cset->subsys[ssid]);
+        }
        hash_del(&cset->hlist);
        css_set_count--;
@@ -1056,9 +1064,13 @@ static struct css_set *find_css_set(struct css_set *old_cset,
        key = css_set_hash(cset->subsys);
        hash_add(css_set_table, &cset->hlist, key);
-        for_each_subsys(ss, ssid)
+        for_each_subsys(ss, ssid) {
+                struct cgroup_subsys_state *css = cset->subsys[ssid];
                list_add_tail(&cset->e_cset_node[ssid],
-                              &cset->subsys[ssid]->cgroup->e_csets[ssid]);
+                              &css->cgroup->e_csets[ssid]);
+                css_get(css);
+        }
        spin_unlock_bh(&css_set_lock);
@@ -1393,6 +1405,16 @@ static void cgroup_rm_file(struct cgroup *cgrp, const struct cftype *cft)
        char name[CGROUP_FILE_NAME_MAX];
        lockdep_assert_held(&cgroup_mutex);
+        if (cft->file_offset) {
+                struct cgroup_subsys_state *css = cgroup_css(cgrp, cft->ss);
+                struct cgroup_file *cfile = (void *)css + cft->file_offset;
+                spin_lock_irq(&cgroup_file_kn_lock);
+                cfile->kn = NULL;
+                spin_unlock_irq(&cgroup_file_kn_lock);
+        }
        kernfs_remove_by_name(cgrp->kn, cgroup_file_name(cgrp, cft, name));
 }
@@ -1856,7 +1878,6 @@ static void init_cgroup_housekeeping(struct cgroup *cgrp)
        INIT_LIST_HEAD(&cgrp->self.sibling);
        INIT_LIST_HEAD(&cgrp->self.children);
-        INIT_LIST_HEAD(&cgrp->self.files);
        INIT_LIST_HEAD(&cgrp->cset_links);
        INIT_LIST_HEAD(&cgrp->pidlists);
        mutex_init(&cgrp->pidlist_mutex);
@@ -2216,6 +2237,9 @@ struct cgroup_taskset {
        struct list_head        src_csets;
        struct list_head        dst_csets;
+        /* the subsys currently being processed */
+        int                     ssid;
        /*
         * Fields for cgroup_taskset_*() iteration.
         *
@@ -2278,25 +2302,29 @@ static void cgroup_taskset_add(struct task_struct *task,
 /**
 * cgroup_taskset_first - reset taskset and return the first task
 * @tset: taskset of interest
+ * @dst_cssp: output variable for the destination css
 *
 * @tset iteration is initialized and the first task is returned.
 */
-struct task_struct *cgroup_taskset_first(struct cgroup_taskset *tset)
+struct task_struct *cgroup_taskset_first(struct cgroup_taskset *tset,
+                                         struct cgroup_subsys_state **dst_cssp)
 {
        tset->cur_cset = list_first_entry(tset->csets, struct css_set, mg_node);
        tset->cur_task = NULL;
-        return cgroup_taskset_next(tset);
+        return cgroup_taskset_next(tset, dst_cssp);
 }
 /**
 * cgroup_taskset_next - iterate to the next task in taskset
 * @tset: taskset of interest
+ * @dst_cssp: output variable for the destination css
 *
 * Return the next task in @tset.  Iteration must have been initialized
 * with cgroup_taskset_first().
 */
-struct task_struct *cgroup_taskset_next(struct cgroup_taskset *tset)
+struct task_struct *cgroup_taskset_next(struct cgroup_taskset *tset,
+                                        struct cgroup_subsys_state **dst_cssp)
 {
        struct css_set *cset = tset->cur_cset;
        struct task_struct *task = tset->cur_task;
@@ -2311,6 +2339,18 @@ struct task_struct *cgroup_taskset_next(struct cgroup_taskset *tset)
                if (&task->cg_list != &cset->mg_tasks) {
                        tset->cur_cset = cset;
                        tset->cur_task = task;
+                        /*
+                         * This function may be called both before and
+                         * after cgroup_taskset_migrate().  The two cases
+                         * can be distinguished by looking at whether @cset
+                         * has its ->mg_dst_cset set.
+                         */
+                        if (cset->mg_dst_cset)
+                                *dst_cssp = cset->mg_dst_cset->subsys[tset->ssid];
+                        else
+                                *dst_cssp = cset->subsys[tset->ssid];
                        return task;
                }
@@ -2346,7 +2386,8 @@ static int cgroup_taskset_migrate(struct cgroup_taskset *tset,
        /* check that we can legitimately attach to the cgroup */
        for_each_e_css(css, i, dst_cgrp) {
                if (css->ss->can_attach) {
-                        ret = css->ss->can_attach(css, tset);
+                        tset->ssid = i;
+                        ret = css->ss->can_attach(tset);
                        if (ret) {
                                failed_css = css;
                                goto out_cancel_attach;
@@ -2379,9 +2420,12 @@ static int cgroup_taskset_migrate(struct cgroup_taskset *tset,
         */
        tset->csets = &tset->dst_csets;
-        for_each_e_css(css, i, dst_cgrp)
+        for_each_e_css(css, i, dst_cgrp) {
-                if (css->ss->attach)
+                if (css->ss->attach) {
-                        css->ss->attach(css, tset);
+                        tset->ssid = i;
+                        css->ss->attach(tset);
+                }
+        }
        ret = 0;
        goto out_release_tset;
@@ -2390,8 +2434,10 @@ out_cancel_attach:
        for_each_e_css(css, i, dst_cgrp) {
                if (css == failed_css)
                        break;
-                if (css->ss->cancel_attach)
+                if (css->ss->cancel_attach) {
-                        css->ss->cancel_attach(css, tset);
+                        tset->ssid = i;
+                        css->ss->cancel_attach(tset);
+                }
        }
 out_release_tset:
        spin_lock_bh(&css_set_lock);
@@ -3313,9 +3359,9 @@ static int cgroup_add_file(struct cgroup_subsys_state *css, struct cgroup *cgrp,
        if (cft->file_offset) {
                struct cgroup_file *cfile = (void *)css + cft->file_offset;
-                kernfs_get(kn);
+                spin_lock_irq(&cgroup_file_kn_lock);
                cfile->kn = kn;
-                list_add(&cfile->node, &css->files);
+                spin_unlock_irq(&cgroup_file_kn_lock);
        }
        return 0;
@@ -3553,6 +3599,22 @@ int cgroup_add_legacy_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
 }
 /**
+ * cgroup_file_notify - generate a file modified event for a cgroup_file
+ * @cfile: target cgroup_file
+ *
+ * @cfile must have been obtained by setting cftype->file_offset.
+ */
+void cgroup_file_notify(struct cgroup_file *cfile)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&cgroup_file_kn_lock, flags);
+        if (cfile->kn)
+                kernfs_notify(cfile->kn);
+        spin_unlock_irqrestore(&cgroup_file_kn_lock, flags);
+}
+/**
 * cgroup_task_count - count the number of tasks in a cgroup.
 * @cgrp: the cgroup in question
 *
@@ -4613,13 +4675,9 @@ static void css_free_work_fn(struct work_struct *work)
                container_of(work, struct cgroup_subsys_state, destroy_work);
        struct cgroup_subsys *ss = css->ss;
        struct cgroup *cgrp = css->cgroup;
-        struct cgroup_file *cfile;
        percpu_ref_exit(&css->refcnt);
-        list_for_each_entry(cfile, &css->files, node)
-                kernfs_put(cfile->kn);
        if (ss) {
                /* css free path */
                int id = css->id;
@@ -4724,7 +4782,6 @@ static void init_and_link_css(struct cgroup_subsys_state *css,
        css->ss = ss;
        INIT_LIST_HEAD(&css->sibling);
        INIT_LIST_HEAD(&css->children);
-        INIT_LIST_HEAD(&css->files);
        css->serial_nr = css_serial_nr_next++;
        if (cgroup_parent(cgrp)) {
diff --git a/kernel/cgroup_freezer.c b/kernel/cgroup_freezer.c
index f1b30ad5dc6d..2d3df82c54f2 100644
--- a/kernel/cgroup_freezer.c
+++ b/kernel/cgroup_freezer.c
@@ -155,12 +155,10 @@ static void freezer_css_free(struct cgroup_subsys_state *css)
 * @freezer->lock.  freezer_attach() makes the new tasks conform to the
 * current state and all following state changes can see the new tasks.
 */
-static void freezer_attach(struct cgroup_subsys_state *new_css,
+static void freezer_attach(struct cgroup_taskset *tset)
-                           struct cgroup_taskset *tset)
 {
-        struct freezer *freezer = css_freezer(new_css);
        struct task_struct *task;
-        bool clear_frozen = false;
+        struct cgroup_subsys_state *new_css;
        mutex_lock(&freezer_mutex);
@@ -174,22 +172,21 @@ static void freezer_attach(struct cgroup_subsys_state *new_css,
         * current state before executing the following - !frozen tasks may
         * be visible in a FROZEN cgroup and frozen tasks in a THAWED one.
         */
-        cgroup_taskset_for_each(task, tset) {
+        cgroup_taskset_for_each(task, new_css, tset) {
+                struct freezer *freezer = css_freezer(new_css);
                if (!(freezer->state & CGROUP_FREEZING)) {
                        __thaw_task(task);
                } else {
                        freeze_task(task);
-                        freezer->state &= ~CGROUP_FROZEN;
+                        /* clear FROZEN and propagate upwards */
-                        clear_frozen = true;
+                        while (freezer && (freezer->state & CGROUP_FROZEN)) {
+                                freezer->state &= ~CGROUP_FROZEN;
+                                freezer = parent_freezer(freezer);
+                        }
                }
        }
-        /* propagate FROZEN clearing upwards */
-        while (clear_frozen && (freezer = parent_freezer(freezer))) {
-                freezer->state &= ~CGROUP_FROZEN;
-                clear_frozen = freezer->state & CGROUP_FREEZING;
-        }
        mutex_unlock(&freezer_mutex);
 }
diff --git a/kernel/cgroup_pids.c b/kernel/cgroup_pids.c
index cdd8df4e991c..b50d5a167fda 100644
--- a/kernel/cgroup_pids.c
+++ b/kernel/cgroup_pids.c
@@ -106,7 +106,7 @@ static void pids_uncharge(struct pids_cgroup *pids, int num)
 {
        struct pids_cgroup *p;
-        for (p = pids; p; p = parent_pids(p))
+        for (p = pids; parent_pids(p); p = parent_pids(p))
                pids_cancel(p, num);
 }
@@ -123,7 +123,7 @@ static void pids_charge(struct pids_cgroup *pids, int num)
 {
        struct pids_cgroup *p;
-        for (p = pids; p; p = parent_pids(p))
+        for (p = pids; parent_pids(p); p = parent_pids(p))
                atomic64_add(num, &p->counter);
 }
@@ -140,7 +140,7 @@ static int pids_try_charge(struct pids_cgroup *pids, int num)
 {
        struct pids_cgroup *p, *q;
-        for (p = pids; p; p = parent_pids(p)) {
+        for (p = pids; parent_pids(p); p = parent_pids(p)) {
                int64_t new = atomic64_add_return(num, &p->counter);
                /*
@@ -162,13 +162,13 @@ revert:
        return -EAGAIN;
 }
-static int pids_can_attach(struct cgroup_subsys_state *css,
+static int pids_can_attach(struct cgroup_taskset *tset)
-                           struct cgroup_taskset *tset)
 {
-        struct pids_cgroup *pids = css_pids(css);
        struct task_struct *task;
+        struct cgroup_subsys_state *dst_css;
-        cgroup_taskset_for_each(task, tset) {
+        cgroup_taskset_for_each(task, dst_css, tset) {
+                struct pids_cgroup *pids = css_pids(dst_css);
                struct cgroup_subsys_state *old_css;
                struct pids_cgroup *old_pids;
@@ -187,13 +187,13 @@ static int pids_can_attach(struct cgroup_subsys_state *css,
        return 0;
 }
-static void pids_cancel_attach(struct cgroup_subsys_state *css,
+static void pids_cancel_attach(struct cgroup_taskset *tset)
-                               struct cgroup_taskset *tset)
 {
-        struct pids_cgroup *pids = css_pids(css);
        struct task_struct *task;
+        struct cgroup_subsys_state *dst_css;
-        cgroup_taskset_for_each(task, tset) {
+        cgroup_taskset_for_each(task, dst_css, tset) {
+                struct pids_cgroup *pids = css_pids(dst_css);
                struct cgroup_subsys_state *old_css;
                struct pids_cgroup *old_pids;
@@ -205,65 +205,28 @@ static void pids_cancel_attach(struct cgroup_subsys_state *css,
        }
 }
+/*
+ * task_css_check(true) in pids_can_fork() and pids_cancel_fork() relies
+ * on threadgroup_change_begin() held by the copy_process().
+ */
 static int pids_can_fork(struct task_struct *task, void **priv_p)
 {
        struct cgroup_subsys_state *css;
        struct pids_cgroup *pids;
-        int err;
-        /*
+        css = task_css_check(current, pids_cgrp_id, true);
-         * Use the "current" task_css for the pids subsystem as the tentative
-         * css. It is possible we will charge the wrong hierarchy, in which
-         * case we will forcefully revert/reapply the charge on the right
-         * hierarchy after it is committed to the task proper.
-         */
-        css = task_get_css(current, pids_cgrp_id);
        pids = css_pids(css);
+        return pids_try_charge(pids, 1);
-        err = pids_try_charge(pids, 1);
-        if (err)
-                goto err_css_put;
-        *priv_p = css;
-        return 0;
-err_css_put:
-        css_put(css);
-        return err;
 }
 static void pids_cancel_fork(struct task_struct *task, void *priv)
 {
-        struct cgroup_subsys_state *css = priv;
-        struct pids_cgroup *pids = css_pids(css);
-        pids_uncharge(pids, 1);
-        css_put(css);
-}
-static void pids_fork(struct task_struct *task, void *priv)
-{
        struct cgroup_subsys_state *css;
-        struct cgroup_subsys_state *old_css = priv;
        struct pids_cgroup *pids;
-        struct pids_cgroup *old_pids = css_pids(old_css);
-        css = task_get_css(task, pids_cgrp_id);
+        css = task_css_check(current, pids_cgrp_id, true);
        pids = css_pids(css);
+        pids_uncharge(pids, 1);
-        /*
-         * If the association has changed, we have to revert and reapply the
-         * charge/uncharge on the wrong hierarchy to the current one. Since
-         * the association can only change due to an organisation event, its
-         * okay for us to ignore the limit in this case.
-         */
-        if (pids != old_pids) {
-                pids_uncharge(old_pids, 1);
-                pids_charge(pids, 1);
-        }
-        css_put(css);
-        css_put(old_css);
 }
 static void pids_free(struct task_struct *task)
@@ -335,6 +298,7 @@ static struct cftype pids_files[] = {
        {
                .name = "current",
                .read_s64 = pids_current_read,
+                .flags = CFTYPE_NOT_ON_ROOT,
        },
        { }     /* terminate */
 };
@@ -346,7 +310,6 @@ struct cgroup_subsys pids_cgrp_subsys = {
        .cancel_attach  = pids_cancel_attach,
        .can_fork       = pids_can_fork,
        .cancel_fork    = pids_cancel_fork,
-        .fork           = pids_fork,
        .free           = pids_free,
        .legacy_cftypes = pids_files,
        .dfl_cftypes    = pids_files,
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 10ae73611d80..02a8ea5c9963 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -1429,15 +1429,16 @@ static int fmeter_getrate(struct fmeter *fmp)
 static struct cpuset *cpuset_attach_old_cs;
 /* Called by cgroups to determine if a cpuset is usable; cpuset_mutex held */
-static int cpuset_can_attach(struct cgroup_subsys_state *css,
+static int cpuset_can_attach(struct cgroup_taskset *tset)
-                             struct cgroup_taskset *tset)
 {
-        struct cpuset *cs = css_cs(css);
+        struct cgroup_subsys_state *css;
+        struct cpuset *cs;
        struct task_struct *task;
        int ret;
        /* used later by cpuset_attach() */
-        cpuset_attach_old_cs = task_cs(cgroup_taskset_first(tset));
+        cpuset_attach_old_cs = task_cs(cgroup_taskset_first(tset, &css));
+        cs = css_cs(css);
        mutex_lock(&cpuset_mutex);
@@ -1447,7 +1448,7 @@ static int cpuset_can_attach(struct cgroup_subsys_state *css,
            (cpumask_empty(cs->cpus_allowed) || nodes_empty(cs->mems_allowed)))
                goto out_unlock;
-        cgroup_taskset_for_each(task, tset) {
+        cgroup_taskset_for_each(task, css, tset) {
                ret = task_can_attach(task, cs->cpus_allowed);
                if (ret)
                        goto out_unlock;
@@ -1467,9 +1468,14 @@ out_unlock:
        return ret;
 }
-static void cpuset_cancel_attach(struct cgroup_subsys_state *css,
+static void cpuset_cancel_attach(struct cgroup_taskset *tset)
-                                 struct cgroup_taskset *tset)
 {
+        struct cgroup_subsys_state *css;
+        struct cpuset *cs;
+        cgroup_taskset_first(tset, &css);
+        cs = css_cs(css);
        mutex_lock(&cpuset_mutex);
        css_cs(css)->attach_in_progress--;
        mutex_unlock(&cpuset_mutex);
@@ -1482,16 +1488,19 @@ static void cpuset_cancel_attach(struct cgroup_subsys_state *css,
 */
 static cpumask_var_t cpus_attach;
-static void cpuset_attach(struct cgroup_subsys_state *css,
+static void cpuset_attach(struct cgroup_taskset *tset)
-                          struct cgroup_taskset *tset)
 {
        /* static buf protected by cpuset_mutex */
        static nodemask_t cpuset_attach_nodemask_to;
        struct task_struct *task;
        struct task_struct *leader;
-        struct cpuset *cs = css_cs(css);
+        struct cgroup_subsys_state *css;
+        struct cpuset *cs;
        struct cpuset *oldcs = cpuset_attach_old_cs;
+        cgroup_taskset_first(tset, &css);
+        cs = css_cs(css);
        mutex_lock(&cpuset_mutex);
        /* prepare for attach */
@@ -1502,7 +1511,7 @@ static void cpuset_attach(struct cgroup_subsys_state *css,
        guarantee_online_mems(cs, &cpuset_attach_nodemask_to);
-        cgroup_taskset_for_each(task, tset) {
+        cgroup_taskset_for_each(task, css, tset) {
                /*
                 * can_attach beforehand should guarantee that this doesn't
                 * fail.  TODO: have a better way to handle failure here
@@ -1518,7 +1527,7 @@ static void cpuset_attach(struct cgroup_subsys_state *css,
         * sleep and should be moved outside migration path proper.
         */
        cpuset_attach_nodemask_to = cs->effective_mems;
-        cgroup_taskset_for_each_leader(leader, tset) {
+        cgroup_taskset_for_each_leader(leader, css, tset) {
                struct mm_struct *mm = get_task_mm(leader);
                if (mm) {
diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c
index d659487254d5..9c418002b8c1 100644
--- a/kernel/events/callchain.c
+++ b/kernel/events/callchain.c
@@ -3,7 +3,7 @@
 *
 *  Copyright (C) 2008 Thomas Gleixner <tglx@linutronix.de>
 *  Copyright (C) 2008-2011 Red Hat, Inc., Ingo Molnar
- *  Copyright (C) 2008-2011 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2008-2011 Red Hat, Inc., Peter Zijlstra
 *  Copyright  �  2009 Paul Mackerras, IBM Corp. <paulus@au1.ibm.com>
 *
 * For licensing details see kernel-base/COPYING
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 36babfd20648..ef2d6ea10736 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3,7 +3,7 @@
 *
 *  Copyright (C) 2008 Thomas Gleixner <tglx@linutronix.de>
 *  Copyright (C) 2008-2011 Red Hat, Inc., Ingo Molnar
- *  Copyright (C) 2008-2011 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2008-2011 Red Hat, Inc., Peter Zijlstra
 *  Copyright  ©  2009 Paul Mackerras, IBM Corp. <paulus@au1.ibm.com>
 *
 * For licensing details see kernel-base/COPYING
@@ -435,7 +435,7 @@ static inline void update_cgrp_time_from_event(struct perf_event *event)
        if (!is_cgroup_event(event))
                return;
-        cgrp = perf_cgroup_from_task(current);
+        cgrp = perf_cgroup_from_task(current, event->ctx);
        /*
         * Do not update time when cgroup is not active
         */
@@ -458,7 +458,7 @@ perf_cgroup_set_timestamp(struct task_struct *task,
        if (!task || !ctx->nr_cgroups)
                return;
-        cgrp = perf_cgroup_from_task(task);
+        cgrp = perf_cgroup_from_task(task, ctx);
        info = this_cpu_ptr(cgrp->info);
        info->timestamp = ctx->timestamp;
 }
@@ -489,7 +489,6 @@ static void perf_cgroup_switch(struct task_struct *task, int mode)
         * we reschedule only in the presence of cgroup
         * constrained events.
         */
-        rcu_read_lock();
        list_for_each_entry_rcu(pmu, &pmus, entry) {
                cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
@@ -522,8 +521,10 @@ static void perf_cgroup_switch(struct task_struct *task, int mode)
                                 * set cgrp before ctxsw in to allow
                                 * event_filter_match() to not have to pass
                                 * task around
+                                 * we pass the cpuctx->ctx to perf_cgroup_from_task()
+                                 * because cgorup events are only per-cpu
                                 */
-                                cpuctx->cgrp = perf_cgroup_from_task(task);
+                                cpuctx->cgrp = perf_cgroup_from_task(task, &cpuctx->ctx);
                                cpu_ctx_sched_in(cpuctx, EVENT_ALL, task);
                        }
                        perf_pmu_enable(cpuctx->ctx.pmu);
@@ -531,8 +532,6 @@ static void perf_cgroup_switch(struct task_struct *task, int mode)
                }
        }
-        rcu_read_unlock();
        local_irq_restore(flags);
 }
@@ -542,17 +541,20 @@ static inline void perf_cgroup_sched_out(struct task_struct *task,
        struct perf_cgroup *cgrp1;
        struct perf_cgroup *cgrp2 = NULL;
+        rcu_read_lock();
        /*
         * we come here when we know perf_cgroup_events > 0
+         * we do not need to pass the ctx here because we know
+         * we are holding the rcu lock
         */
-        cgrp1 = perf_cgroup_from_task(task);
+        cgrp1 = perf_cgroup_from_task(task, NULL);
        /*
         * next is NULL when called from perf_event_enable_on_exec()
         * that will systematically cause a cgroup_switch()
         */
        if (next)
-                cgrp2 = perf_cgroup_from_task(next);
+                cgrp2 = perf_cgroup_from_task(next, NULL);
        /*
         * only schedule out current cgroup events if we know
@@ -561,6 +563,8 @@ static inline void perf_cgroup_sched_out(struct task_struct *task,
         */
        if (cgrp1 != cgrp2)
                perf_cgroup_switch(task, PERF_CGROUP_SWOUT);
+        rcu_read_unlock();
 }
 static inline void perf_cgroup_sched_in(struct task_struct *prev,
@@ -569,13 +573,16 @@ static inline void perf_cgroup_sched_in(struct task_struct *prev,
        struct perf_cgroup *cgrp1;
        struct perf_cgroup *cgrp2 = NULL;
+        rcu_read_lock();
        /*
         * we come here when we know perf_cgroup_events > 0
+         * we do not need to pass the ctx here because we know
+         * we are holding the rcu lock
         */
-        cgrp1 = perf_cgroup_from_task(task);
+        cgrp1 = perf_cgroup_from_task(task, NULL);
        /* prev can never be NULL */
-        cgrp2 = perf_cgroup_from_task(prev);
+        cgrp2 = perf_cgroup_from_task(prev, NULL);
        /*
         * only need to schedule in cgroup events if we are changing
@@ -584,6 +591,8 @@ static inline void perf_cgroup_sched_in(struct task_struct *prev,
         */
        if (cgrp1 != cgrp2)
                perf_cgroup_switch(task, PERF_CGROUP_SWIN);
+        rcu_read_unlock();
 }
 static inline int perf_cgroup_connect(int fd, struct perf_event *event,
@@ -4216,7 +4225,14 @@ retry:
                goto retry;
        }
-        __perf_event_period(&pe);
+        if (event->attr.freq) {
+                event->attr.sample_freq = value;
+        } else {
+                event->attr.sample_period = value;
+                event->hw.sample_period = value;
+        }
+        local64_set(&event->hw.period_left, 0);
        raw_spin_unlock_irq(&ctx->lock);
        return 0;
@@ -5667,6 +5683,17 @@ perf_event_aux_ctx(struct perf_event_context *ctx,
 }
 static void
+perf_event_aux_task_ctx(perf_event_aux_output_cb output, void *data,
+                        struct perf_event_context *task_ctx)
+{
+        rcu_read_lock();
+        preempt_disable();
+        perf_event_aux_ctx(task_ctx, output, data);
+        preempt_enable();
+        rcu_read_unlock();
+}
+static void
 perf_event_aux(perf_event_aux_output_cb output, void *data,
               struct perf_event_context *task_ctx)
 {
@@ -5675,14 +5702,23 @@ perf_event_aux(perf_event_aux_output_cb output, void *data,
        struct pmu *pmu;
        int ctxn;
+        /*
+         * If we have task_ctx != NULL we only notify
+         * the task context itself. The task_ctx is set
+         * only for EXIT events before releasing task
+         * context.
+         */
+        if (task_ctx) {
+                perf_event_aux_task_ctx(output, data, task_ctx);
+                return;
+        }
        rcu_read_lock();
        list_for_each_entry_rcu(pmu, &pmus, entry) {
                cpuctx = get_cpu_ptr(pmu->pmu_cpu_context);
                if (cpuctx->unique_pmu != pmu)
                        goto next;
                perf_event_aux_ctx(&cpuctx->ctx, output, data);
-                if (task_ctx)
-                        goto next;
                ctxn = pmu->task_ctx_nr;
                if (ctxn < 0)
                        goto next;
@@ -5692,12 +5728,6 @@ perf_event_aux(perf_event_aux_output_cb output, void *data,
 next:
                put_cpu_ptr(pmu->pmu_cpu_context);
        }
-        if (task_ctx) {
-                preempt_disable();
-                perf_event_aux_ctx(task_ctx, output, data);
-                preempt_enable();
-        }
        rcu_read_unlock();
 }
@@ -8787,10 +8817,8 @@ static void perf_event_exit_task_context(struct task_struct *child, int ctxn)
        struct perf_event_context *child_ctx, *clone_ctx = NULL;
        unsigned long flags;
-        if (likely(!child->perf_event_ctxp[ctxn])) {
+        if (likely(!child->perf_event_ctxp[ctxn]))
-                perf_event_task(child, NULL, 0);
                return;
-        }
        local_irq_save(flags);
        /*
@@ -8874,6 +8902,14 @@ void perf_event_exit_task(struct task_struct *child)
        for_each_task_context_nr(ctxn)
                perf_event_exit_task_context(child, ctxn);
+        /*
+         * The perf_event_exit_task_context calls perf_event_task
+         * with child's task_ctx, which generates EXIT events for
+         * child contexts and sets child->perf_event_ctxp[] to NULL.
+         * At this point we need to send EXIT events to cpu contexts.
+         */
+        perf_event_task(child, NULL, 0);
 }
 static void perf_free_event(struct perf_event *event,
@@ -9452,16 +9488,18 @@ static void perf_cgroup_css_free(struct cgroup_subsys_state *css)
 static int __perf_cgroup_move(void *info)
 {
        struct task_struct *task = info;
+        rcu_read_lock();
        perf_cgroup_switch(task, PERF_CGROUP_SWOUT | PERF_CGROUP_SWIN);
+        rcu_read_unlock();
        return 0;
 }
-static void perf_cgroup_attach(struct cgroup_subsys_state *css,
+static void perf_cgroup_attach(struct cgroup_taskset *tset)
-                               struct cgroup_taskset *tset)
 {
        struct task_struct *task;
+        struct cgroup_subsys_state *css;
-        cgroup_taskset_for_each(task, tset)
+        cgroup_taskset_for_each(task, css, tset)
                task_function_call(task, __perf_cgroup_move, task);
 }
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index b5d1ea79c595..adfdc0536117 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -3,7 +3,7 @@
 *
 *  Copyright (C) 2008 Thomas Gleixner <tglx@linutronix.de>
 *  Copyright (C) 2008-2011 Red Hat, Inc., Ingo Molnar
- *  Copyright (C) 2008-2011 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2008-2011 Red Hat, Inc., Peter Zijlstra
 *  Copyright  ©  2009 Paul Mackerras, IBM Corp. <paulus@au1.ibm.com>
 *
 * For licensing details see kernel-base/COPYING
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 4e5e9798aa0c..7dad84913abf 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -19,7 +19,7 @@
 * Authors:
 *      Srikar Dronamraju
 *      Jim Keniston
- * Copyright (C) 2011-2012 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ * Copyright (C) 2011-2012 Red Hat, Inc., Peter Zijlstra
 */
 #include <linux/kernel.h>
diff --git a/kernel/fork.c b/kernel/fork.c
index f97f2c449f5c..fce002ee3ddf 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1368,8 +1368,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
        p->real_start_time = ktime_get_boot_ns();
        p->io_context = NULL;
        p->audit_context = NULL;
-        if (clone_flags & CLONE_THREAD)
+        threadgroup_change_begin(current);
-                threadgroup_change_begin(current);
        cgroup_fork(p);
 #ifdef CONFIG_NUMA
        p->mempolicy = mpol_dup(p->mempolicy);
@@ -1610,8 +1609,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
        proc_fork_connector(p);
        cgroup_post_fork(p, cgrp_ss_priv);
-        if (clone_flags & CLONE_THREAD)
+        threadgroup_change_end(current);
-                threadgroup_change_end(current);
        perf_event_fork(p);
        trace_task_newtask(p, clone_flags);
@@ -1652,8 +1650,7 @@ bad_fork_cleanup_policy:
        mpol_put(p->mempolicy);
 bad_fork_cleanup_threadgroup_lock:
 #endif
-        if (clone_flags & CLONE_THREAD)
+        threadgroup_change_end(current);
-                threadgroup_change_end(current);
        delayacct_tsk_free(p);
 bad_fork_cleanup_count:
        atomic_dec(&p->cred->user->processes);
diff --git a/kernel/irq_work.c b/kernel/irq_work.c
index cbf9fb899d92..bcf107ce0854 100644
--- a/kernel/irq_work.c
+++ b/kernel/irq_work.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ * Copyright (C) 2010 Red Hat, Inc., Peter Zijlstra
 *
 * Provides a framework for enqueueing and running callbacks from hardirq
 * context. The enqueueing is NMI-safe.
diff --git a/kernel/jump_label.c b/kernel/jump_label.c
index f7dd15d537f9..05254eeb4b4e 100644
--- a/kernel/jump_label.c
+++ b/kernel/jump_label.c
@@ -2,7 +2,7 @@
 * jump label support
 *
 * Copyright (C) 2009 Jason Baron <jbaron@redhat.com>
- * Copyright (C) 2011 Peter Zijlstra <pzijlstr@redhat.com>
+ * Copyright (C) 2011 Peter Zijlstra
 *
 */
 #include <linux/memory.h>
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index deae3907ac1e..60ace56618f6 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -6,7 +6,7 @@
 * Started by Ingo Molnar:
 *
 *  Copyright (C) 2006,2007 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
- *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra
 *
 * this code maps all the lock dependencies as they occur in a live kernel
 * and will warn about the following classes of locking bugs:
diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c
index d83d798bef95..dbb61a302548 100644
--- a/kernel/locking/lockdep_proc.c
+++ b/kernel/locking/lockdep_proc.c
@@ -6,7 +6,7 @@
 * Started by Ingo Molnar:
 *
 *  Copyright (C) 2006,2007 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
- *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra
 *
 * Code for /proc/lockdep and /proc/lockdep_stats:
 *
diff --git a/kernel/resource.c b/kernel/resource.c
index f150dbbe6f62..09c0597840b0 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -1498,8 +1498,15 @@ int iomem_is_exclusive(u64 addr)
                        break;
                if (p->end < addr)
                        continue;
-                if (p->flags & IORESOURCE_BUSY &&
+                /*
-                     p->flags & IORESOURCE_EXCLUSIVE) {
+                 * A resource is exclusive if IORESOURCE_EXCLUSIVE is set
+                 * or CONFIG_IO_STRICT_DEVMEM is enabled and the
+                 * resource is busy.
+                 */
+                if ((p->flags & IORESOURCE_BUSY) == 0)
+                        continue;
+                if (IS_ENABLED(CONFIG_IO_STRICT_DEVMEM)
+                                || p->flags & IORESOURCE_EXCLUSIVE) {
                        err = 1;
                        break;
                }
diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
index c0a205101c23..caf4041f5b0a 100644
--- a/kernel/sched/clock.c
+++ b/kernel/sched/clock.c
@@ -1,7 +1,7 @@
 /*
 * sched_clock for unstable cpu clocks
 *
- *  Copyright (C) 2008 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2008 Red Hat, Inc., Peter Zijlstra
 *
 *  Updates and enhancements:
 *    Copyright (C) 2008 Red Hat, Inc. Steven Rostedt <srostedt@redhat.com>
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 7063c6a07440..732e993b564b 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -8241,12 +8241,12 @@ static void cpu_cgroup_fork(struct task_struct *task, void *private)
        sched_move_task(task);
 }
-static int cpu_cgroup_can_attach(struct cgroup_subsys_state *css,
+static int cpu_cgroup_can_attach(struct cgroup_taskset *tset)
-                                 struct cgroup_taskset *tset)
 {
        struct task_struct *task;
+        struct cgroup_subsys_state *css;
-        cgroup_taskset_for_each(task, tset) {
+        cgroup_taskset_for_each(task, css, tset) {
 #ifdef CONFIG_RT_GROUP_SCHED
                if (!sched_rt_can_attach(css_tg(css), task))
                        return -EINVAL;
@@ -8259,12 +8259,12 @@ static int cpu_cgroup_can_attach(struct cgroup_subsys_state *css,
        return 0;
 }
-static void cpu_cgroup_attach(struct cgroup_subsys_state *css,
+static void cpu_cgroup_attach(struct cgroup_taskset *tset)
-                              struct cgroup_taskset *tset)
 {
        struct task_struct *task;
+        struct cgroup_subsys_state *css;
-        cgroup_taskset_for_each(task, tset)
+        cgroup_taskset_for_each(task, css, tset)
                sched_move_task(task);
 }
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index f04fda8f669c..90e26b11deaa 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -17,7 +17,7 @@
 *  Copyright (C) 2007, Thomas Gleixner <tglx@linutronix.de>
 *
 *  Adaptive scheduling granularity, math enhancements by Peter Zijlstra
- *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra
 */
 #include <linux/latencytop.h>
diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c
index f10bd873e684..f15d6b6a538a 100644
--- a/kernel/sched/wait.c
+++ b/kernel/sched/wait.c
@@ -392,7 +392,7 @@ __wait_on_bit(wait_queue_head_t *wq, struct wait_bit_queue *q,
        do {
                prepare_to_wait(wq, &q->wait, mode);
                if (test_bit(q->key.bit_nr, q->key.flags))
-                        ret = (*action)(&q->key);
+                        ret = (*action)(&q->key, mode);
        } while (test_bit(q->key.bit_nr, q->key.flags) && !ret);
        finish_wait(wq, &q->wait);
        return ret;
@@ -431,7 +431,7 @@ __wait_on_bit_lock(wait_queue_head_t *wq, struct wait_bit_queue *q,
                prepare_to_wait_exclusive(wq, &q->wait, mode);
                if (!test_bit(q->key.bit_nr, q->key.flags))
                        continue;
-                ret = action(&q->key);
+                ret = action(&q->key, mode);
                if (!ret)
                        continue;
                abort_exclusive_wait(wq, &q->wait, mode, &q->key);
@@ -581,43 +581,43 @@ void wake_up_atomic_t(atomic_t *p)
 }
 EXPORT_SYMBOL(wake_up_atomic_t);
-__sched int bit_wait(struct wait_bit_key *word)
+__sched int bit_wait(struct wait_bit_key *word, int mode)
 {
        schedule();
-        if (signal_pending(current))
+        if (signal_pending_state(mode, current))
                return -EINTR;
        return 0;
 }
 EXPORT_SYMBOL(bit_wait);
-__sched int bit_wait_io(struct wait_bit_key *word)
+__sched int bit_wait_io(struct wait_bit_key *word, int mode)
 {
        io_schedule();
-        if (signal_pending(current))
+        if (signal_pending_state(mode, current))
                return -EINTR;
        return 0;
 }
 EXPORT_SYMBOL(bit_wait_io);
-__sched int bit_wait_timeout(struct wait_bit_key *word)
+__sched int bit_wait_timeout(struct wait_bit_key *word, int mode)
 {
        unsigned long now = READ_ONCE(jiffies);
        if (time_after_eq(now, word->timeout))
                return -EAGAIN;
        schedule_timeout(word->timeout - now);
-        if (signal_pending(current))
+        if (signal_pending_state(mode, current))
                return -EINTR;
        return 0;
 }
 EXPORT_SYMBOL_GPL(bit_wait_timeout);
-__sched int bit_wait_io_timeout(struct wait_bit_key *word)
+__sched int bit_wait_io_timeout(struct wait_bit_key *word, int mode)
 {
        unsigned long now = READ_ONCE(jiffies);
        if (time_after_eq(now, word->timeout))
                return -EAGAIN;
        io_schedule_timeout(word->timeout - now);
-        if (signal_pending(current))
+        if (signal_pending_state(mode, current))
                return -EINTR;
        return 0;
 }
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 867bc20e1ef1..a3bbaee77c58 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -531,7 +531,7 @@ static int __init cpu_stop_init(void)
 }
 early_initcall(cpu_stop_init);
-#ifdef CONFIG_STOP_MACHINE
+#if defined(CONFIG_SMP) || defined(CONFIG_HOTPLUG_CPU)
 static int __stop_machine(cpu_stop_fn_t fn, void *data, const struct cpumask *cpus)
 {
@@ -631,4 +631,4 @@ int stop_machine_from_inactive_cpu(cpu_stop_fn_t fn, void *data,
        return ret ?: done.ret;
 }
-#endif  /* CONFIG_STOP_MACHINE */
+#endif  /* CONFIG_SMP || CONFIG_HOTPLUG_CPU */
diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
index abfc903e741e..cc9f7a9319be 100644
--- a/kernel/trace/trace_event_perf.c
+++ b/kernel/trace/trace_event_perf.c
@@ -1,7 +1,7 @@
 /*
 * trace event based perf event profiling/tracing
 *
- * Copyright (C) 2009 Red Hat Inc, Peter Zijlstra <pzijlstr@redhat.com>
+ * Copyright (C) 2009 Red Hat Inc, Peter Zijlstra
 * Copyright (C) 2009-2010 Frederic Weisbecker <fweisbec@gmail.com>
 */
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 8c15b29d5adc..073496dea848 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1853,3 +1853,42 @@ source "samples/Kconfig"
 source "lib/Kconfig.kgdb"
+config ARCH_HAS_DEVMEM_IS_ALLOWED
+        bool
+config STRICT_DEVMEM
+        bool "Filter access to /dev/mem"
+        depends on MMU
+        depends on ARCH_HAS_DEVMEM_IS_ALLOWED
+        default y if TILE || PPC
+        ---help---
+          If this option is disabled, you allow userspace (root) access to all
+          of memory, including kernel and userspace memory. Accidental
+          access to this is obviously disastrous, but specific access can
+          be used by people debugging the kernel. Note that with PAT support
+          enabled, even in this case there are restrictions on /dev/mem
+          use due to the cache aliasing requirements.
+          If this option is switched on, and IO_STRICT_DEVMEM=n, the /dev/mem
+          file only allows userspace access to PCI space and the BIOS code and
+          data regions.  This is sufficient for dosemu and X and all common
+          users of /dev/mem.
+          If in doubt, say Y.
+config IO_STRICT_DEVMEM
+        bool "Filter I/O access to /dev/mem"
+        depends on STRICT_DEVMEM
+        default STRICT_DEVMEM
+        ---help---
+          If this option is disabled, you allow userspace (root) access to all
+          io-memory regardless of whether a driver is actively using that
+          range.  Accidental access to this is obviously disastrous, but
+          specific access can be used by people debugging kernel drivers.
+          If this option is switched on, the /dev/mem file only allows
+          userspace access to *idle* io-memory ranges (see /proc/iomem) This
+          may break traditional users of /dev/mem (dosemu, legacy X, etc...)
+          if the driver using a given range cannot be disabled.
+          If in doubt, say Y.
diff --git a/lib/btree.c b/lib/btree.c
index 4264871ea1a0..f93a945274af 100644
--- a/lib/btree.c
+++ b/lib/btree.c
@@ -5,7 +5,7 @@
 *
 * Copyright (c) 2007-2008 Joern Engel <joern@logfs.org>
 * Bits and pieces stolen from Peter Zijlstra's code, which is
- * Copyright 2007, Red Hat Inc. Peter Zijlstra <pzijlstr@redhat.com>
+ * Copyright 2007, Red Hat Inc. Peter Zijlstra
 * GPLv2
 *
 * see http://programming.kicks-ass.net/kernel-patches/vma_lookup/btree.patch
diff --git a/lib/proportions.c b/lib/proportions.c
index 6f724298f67a..efa54f259ea9 100644
--- a/lib/proportions.c
+++ b/lib/proportions.c
@@ -1,7 +1,7 @@
 /*
 * Floating proportions
 *
- *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra
 *
 * Description:
 *
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 8ed2ffd963c5..7340353f8aea 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -957,8 +957,9 @@ EXPORT_SYMBOL(congestion_wait);
 * jiffies for either a BDI to exit congestion of the given @sync queue
 * or a write to complete.
 *
- * In the absence of zone congestion, cond_resched() is called to yield
+ * In the absence of zone congestion, a short sleep or a cond_resched is
- * the processor if necessary but otherwise does not sleep.
+ * performed to yield the processor and to allow other subsystems to make
+ * a forward progress.
 *
 * The return value is 0 if the sleep is for the full timeout. Otherwise,
 * it is the number of jiffies that were still remaining when the function
@@ -978,7 +979,19 @@ long wait_iff_congested(struct zone *zone, int sync, long timeout)
         */
        if (atomic_read(&nr_wb_congested[sync]) == 0 ||
            !test_bit(ZONE_CONGESTED, &zone->flags)) {
-                cond_resched();
+                /*
+                 * Memory allocation/reclaim might be called from a WQ
+                 * context and the current implementation of the WQ
+                 * concurrency control doesn't recognize that a particular
+                 * WQ is congested if the worker thread is looping without
+                 * ever sleeping. Therefore we have to do a short sleep
+                 * here rather than calling cond_resched().
+                 */
+                if (current->flags & PF_WQ_WORKER)
+                        schedule_timeout(1);
+                else
+                        cond_resched();
                /* In case we scheduled, work out time remaining */
                ret = timeout - (jiffies - start);
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 827bb02a43a4..ef6963b577fd 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -372,8 +372,10 @@ retry_locked:
                spin_unlock(&resv->lock);
                trg = kmalloc(sizeof(*trg), GFP_KERNEL);
-                if (!trg)
+                if (!trg) {
+                        kfree(nrg);
                        return -ENOMEM;
+                }
                spin_lock(&resv->lock);
                list_add(&trg->link, &resv->region_cache);
@@ -483,8 +485,16 @@ static long region_del(struct resv_map *resv, long f, long t)
 retry:
        spin_lock(&resv->lock);
        list_for_each_entry_safe(rg, trg, head, link) {
-                if (rg->to <= f)
+                /*
+                 * Skip regions before the range to be deleted.  file_region
+                 * ranges are normally of the form [from, to).  However, there
+                 * may be a "placeholder" entry in the map which is of the form
+                 * (from, to) with from == to.  Check for placeholder entries
+                 * at the beginning of the range to be deleted.
+                 */
+                if (rg->to <= f && (rg->to != rg->from || rg->to != f))
                        continue;
                if (rg->from >= t)
                        break;
@@ -1886,7 +1896,10 @@ struct page *alloc_huge_page(struct vm_area_struct *vma,
                page = __alloc_buddy_huge_page_with_mpol(h, vma, addr);
                if (!page)
                        goto out_uncharge_cgroup;
+                if (!avoid_reserve && vma_has_reserves(vma, gbl_chg)) {
+                        SetPagePrivate(page);
+                        h->resv_huge_pages--;
+                }
                spin_lock(&hugetlb_lock);
                list_move(&page->lru, &h->hugepage_activelist);
                /* Fall through */
@@ -3693,12 +3706,12 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                } else if (unlikely(is_hugetlb_entry_hwpoisoned(entry)))
                        return VM_FAULT_HWPOISON_LARGE |
                                VM_FAULT_SET_HINDEX(hstate_index(h));
+        } else {
+                ptep = huge_pte_alloc(mm, address, huge_page_size(h));
+                if (!ptep)
+                        return VM_FAULT_OOM;
        }
-        ptep = huge_pte_alloc(mm, address, huge_page_size(h));
-        if (!ptep)
-                return VM_FAULT_OOM;
        mapping = vma->vm_file->f_mapping;
        idx = vma_hugecache_offset(h, vma, address);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 9acfb165eb52..e234c21a5e6c 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2128,7 +2128,7 @@ done_restock:
         */
        do {
                if (page_counter_read(&memcg->memory) > memcg->high) {
-                        current->memcg_nr_pages_over_high += nr_pages;
+                        current->memcg_nr_pages_over_high += batch;
                        set_notify_resume(current);
                        break;
                }
@@ -4779,23 +4779,18 @@ static void mem_cgroup_clear_mc(void)
        spin_unlock(&mc.lock);
 }
-static int mem_cgroup_can_attach(struct cgroup_subsys_state *css,
+static int mem_cgroup_can_attach(struct cgroup_taskset *tset)
-                                 struct cgroup_taskset *tset)
 {
-        struct mem_cgroup *memcg = mem_cgroup_from_css(css);
+        struct cgroup_subsys_state *css;
+        struct mem_cgroup *memcg;
        struct mem_cgroup *from;
        struct task_struct *leader, *p;
        struct mm_struct *mm;
        unsigned long move_flags;
        int ret = 0;
-        /*
+        /* charge immigration isn't supported on the default hierarchy */
-         * We are now commited to this value whatever it is. Changes in this
+        if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
-         * tunable will only affect upcoming migrations, not the current one.
-         * So we need to save it, and keep it going.
-         */
-        move_flags = READ_ONCE(memcg->move_charge_at_immigrate);
-        if (!move_flags)
                return 0;
        /*
@@ -4805,13 +4800,23 @@ static int mem_cgroup_can_attach(struct cgroup_subsys_state *css,
         * multiple.
         */
        p = NULL;
-        cgroup_taskset_for_each_leader(leader, tset) {
+        cgroup_taskset_for_each_leader(leader, css, tset) {
                WARN_ON_ONCE(p);
                p = leader;
+                memcg = mem_cgroup_from_css(css);
        }
        if (!p)
                return 0;
+        /*
+         * We are now commited to this value whatever it is. Changes in this
+         * tunable will only affect upcoming migrations, not the current one.
+         * So we need to save it, and keep it going.
+         */
+        move_flags = READ_ONCE(memcg->move_charge_at_immigrate);
+        if (!move_flags)
+                return 0;
        from = mem_cgroup_from_task(p);
        VM_BUG_ON(from == memcg);
@@ -4842,8 +4847,7 @@ static int mem_cgroup_can_attach(struct cgroup_subsys_state *css,
        return ret;
 }
-static void mem_cgroup_cancel_attach(struct cgroup_subsys_state *css,
+static void mem_cgroup_cancel_attach(struct cgroup_taskset *tset)
-                                     struct cgroup_taskset *tset)
 {
        if (mc.to)
                mem_cgroup_clear_mc();
@@ -4985,10 +4989,10 @@ retry:
        atomic_dec(&mc.from->moving_account);
 }
-static void mem_cgroup_move_task(struct cgroup_subsys_state *css,
+static void mem_cgroup_move_task(struct cgroup_taskset *tset)
-                                 struct cgroup_taskset *tset)
 {
-        struct task_struct *p = cgroup_taskset_first(tset);
+        struct cgroup_subsys_state *css;
+        struct task_struct *p = cgroup_taskset_first(tset, &css);
        struct mm_struct *mm = get_task_mm(p);
        if (mm) {
@@ -5000,17 +5004,14 @@ static void mem_cgroup_move_task(struct cgroup_subsys_state *css,
                mem_cgroup_clear_mc();
 }
 #else   /* !CONFIG_MMU */
-static int mem_cgroup_can_attach(struct cgroup_subsys_state *css,
+static int mem_cgroup_can_attach(struct cgroup_taskset *tset)
-                                 struct cgroup_taskset *tset)
 {
        return 0;
 }
-static void mem_cgroup_cancel_attach(struct cgroup_subsys_state *css,
+static void mem_cgroup_cancel_attach(struct cgroup_taskset *tset)
-                                     struct cgroup_taskset *tset)
 {
 }
-static void mem_cgroup_move_task(struct cgroup_subsys_state *css,
+static void mem_cgroup_move_task(struct cgroup_taskset *tset)
-                                 struct cgroup_taskset *tset)
 {
 }
 #endif
@@ -5511,11 +5512,11 @@ void mem_cgroup_uncharge_list(struct list_head *page_list)
 * mem_cgroup_replace_page - migrate a charge to another page
 * @oldpage: currently charged page
 * @newpage: page to transfer the charge to
- * @lrucare: either or both pages might be on the LRU already
 *
 * Migrate the charge from @oldpage to @newpage.
 *
 * Both pages must be locked, @newpage->mapping must be set up.
+ * Either or both pages might be on the LRU already.
 */
 void mem_cgroup_replace_page(struct page *oldpage, struct page *newpage)
 {
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index d13a33918fa2..c12680993ff3 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -608,6 +608,8 @@ void oom_kill_process(struct oom_control *oc, struct task_struct *p,
                        continue;
                if (unlikely(p->flags & PF_KTHREAD))
                        continue;
+                if (is_global_init(p))
+                        continue;
                if (p->signal->oom_score_adj == OOM_SCORE_ADJ_MIN)
                        continue;
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 3e4d65445fa7..d15d88c8efa1 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -2,7 +2,7 @@
 * mm/page-writeback.c
 *
 * Copyright (C) 2002, Linus Torvalds.
- * Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ * Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra
 *
 * Contains functions related to writing back dirty pages at the
 * address_space level.
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 17a3c66639a9..9d666df5ef95 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3647,8 +3647,9 @@ static void show_migration_types(unsigned char type)
 {
        static const char types[MIGRATE_TYPES] = {
                [MIGRATE_UNMOVABLE]     = 'U',
-                [MIGRATE_RECLAIMABLE]   = 'E',
                [MIGRATE_MOVABLE]       = 'M',
+                [MIGRATE_RECLAIMABLE]   = 'E',
+                [MIGRATE_HIGHATOMIC]    = 'H',
 #ifdef CONFIG_CMA
                [MIGRATE_CMA]           = 'C',
 #endif
diff --git a/mm/shmem.c b/mm/shmem.c
index 9187eee4128b..2afcdbbdb685 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -843,14 +843,14 @@ static int shmem_writepage(struct page *page, struct writeback_control *wbc)
                list_add_tail(&info->swaplist, &shmem_swaplist);
        if (add_to_swap_cache(page, swap, GFP_ATOMIC) == 0) {
-                swap_shmem_alloc(swap);
-                shmem_delete_from_page_cache(page, swp_to_radix_entry(swap));
                spin_lock(&info->lock);
-                info->swapped++;
                shmem_recalc_inode(inode);
+                info->swapped++;
                spin_unlock(&info->lock);
+                swap_shmem_alloc(swap);
+                shmem_delete_from_page_cache(page, swp_to_radix_entry(swap));
                mutex_unlock(&shmem_swaplist_mutex);
                BUG_ON(page_mapped(page));
                swap_writepage(page, wbc);
@@ -1078,7 +1078,7 @@ repeat:
        if (sgp != SGP_WRITE && sgp != SGP_FALLOC &&
            ((loff_t)index << PAGE_CACHE_SHIFT) >= i_size_read(inode)) {
                error = -EINVAL;
-                goto failed;
+                goto unlock;
        }
        if (page && sgp == SGP_WRITE)
@@ -1246,11 +1246,15 @@ clear:
        /* Perhaps the file has been truncated since we checked */
        if (sgp != SGP_WRITE && sgp != SGP_FALLOC &&
            ((loff_t)index << PAGE_CACHE_SHIFT) >= i_size_read(inode)) {
+                if (alloced) {
+                        ClearPageDirty(page);
+                        delete_from_page_cache(page);
+                        spin_lock(&info->lock);
+                        shmem_recalc_inode(inode);
+                        spin_unlock(&info->lock);
+                }
                error = -EINVAL;
-                if (alloced)
+                goto unlock;
-                        goto trunc;
-                else
-                        goto failed;
        }
        *pagep = page;
        return 0;
@@ -1258,23 +1262,13 @@ clear:
        /*
         * Error recovery.
         */
-trunc:
-        info = SHMEM_I(inode);
-        ClearPageDirty(page);
-        delete_from_page_cache(page);
-        spin_lock(&info->lock);
-        info->alloced--;
-        inode->i_blocks -= BLOCKS_PER_PAGE;
-        spin_unlock(&info->lock);
 decused:
-        sbinfo = SHMEM_SB(inode->i_sb);
        if (sbinfo->max_blocks)
                percpu_counter_add(&sbinfo->used_blocks, -1);
 unacct:
        shmem_unacct_blocks(info->flags, 1);
 failed:
-        if (swap.val && error != -EINVAL &&
+        if (swap.val && !shmem_confirm_swap(mapping, index, swap))
-            !shmem_confirm_swap(mapping, index, swap))
                error = -EEXIST;
 unlock:
        if (page) {
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 879a2be23325..0d5712b0206c 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -921,8 +921,8 @@ static void walk_zones_in_node(struct seq_file *m, pg_data_t *pgdat,
 #ifdef CONFIG_PROC_FS
 static char * const migratetype_names[MIGRATE_TYPES] = {
        "Unmovable",
-        "Reclaimable",
        "Movable",
+        "Reclaimable",
        "HighAtomic",
 #ifdef CONFIG_CMA
        "CMA",
@@ -1379,6 +1379,7 @@ static const struct file_operations proc_vmstat_file_operations = {
 #endif /* CONFIG_PROC_FS */
 #ifdef CONFIG_SMP
+static struct workqueue_struct *vmstat_wq;
 static DEFINE_PER_CPU(struct delayed_work, vmstat_work);
 int sysctl_stat_interval __read_mostly = HZ;
 static cpumask_var_t cpu_stat_off;
@@ -1391,7 +1392,7 @@ static void vmstat_update(struct work_struct *w)
                 * to occur in the future. Keep on running the
                 * update worker thread.
                 */
-                schedule_delayed_work_on(smp_processor_id(),
+                queue_delayed_work_on(smp_processor_id(), vmstat_wq,
                        this_cpu_ptr(&vmstat_work),
                        round_jiffies_relative(sysctl_stat_interval));
        } else {
@@ -1460,7 +1461,7 @@ static void vmstat_shepherd(struct work_struct *w)
                if (need_update(cpu) &&
                        cpumask_test_and_clear_cpu(cpu, cpu_stat_off))
-                        schedule_delayed_work_on(cpu,
+                        queue_delayed_work_on(cpu, vmstat_wq,
                                &per_cpu(vmstat_work, cpu), 0);
        put_online_cpus();
@@ -1549,6 +1550,7 @@ static int __init setup_vmstat(void)
        start_shepherd_timer();
        cpu_notifier_register_done();
+        vmstat_wq = alloc_workqueue("vmstat", WQ_FREEZABLE|WQ_MEM_RECLAIM, 0);
 #endif
 #ifdef CONFIG_PROC_FS
        proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c
index 2e4df84c34a1..d9ee8d08a3a6 100644
--- a/net/core/netclassid_cgroup.c
+++ b/net/core/netclassid_cgroup.c
@@ -81,9 +81,11 @@ static void update_classid(struct cgroup_subsys_state *css, void *v)
        css_task_iter_end(&it);
 }
-static void cgrp_attach(struct cgroup_subsys_state *css,
+static void cgrp_attach(struct cgroup_taskset *tset)
-                        struct cgroup_taskset *tset)
 {
+        struct cgroup_subsys_state *css;
+        cgroup_taskset_first(tset, &css);
        update_classid(css,
                       (void *)(unsigned long)css_cls_state(css)->classid);
 }
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index cbd0a199bf52..40fd09fe06ae 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -218,13 +218,14 @@ static int update_netprio(const void *v, struct file *file, unsigned n)
        return 0;
 }
-static void net_prio_attach(struct cgroup_subsys_state *css,
+static void net_prio_attach(struct cgroup_taskset *tset)
-                            struct cgroup_taskset *tset)
 {
        struct task_struct *p;
-        void *v = (void *)(unsigned long)css->cgroup->id;
+        struct cgroup_subsys_state *css;
+        cgroup_taskset_for_each(p, css, tset) {
+                void *v = (void *)(unsigned long)css->cgroup->id;
-        cgroup_taskset_for_each(p, tset) {
                task_lock(p);
                iterate_fd(p->files, 0, update_netprio, v);
                task_unlock(p);
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 95f82d8d4888..229956bf8457 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -353,20 +353,12 @@ void xprt_complete_bc_request(struct rpc_rqst *req, uint32_t copied)
 {
        struct rpc_xprt *xprt = req->rq_xprt;
        struct svc_serv *bc_serv = xprt->bc_serv;
-        struct xdr_buf *rq_rcv_buf = &req->rq_rcv_buf;
        spin_lock(&xprt->bc_pa_lock);
        list_del(&req->rq_bc_pa_list);
        xprt_dec_alloc_count(xprt, 1);
        spin_unlock(&xprt->bc_pa_lock);
-        if (copied <= rq_rcv_buf->head[0].iov_len) {
-                rq_rcv_buf->head[0].iov_len = copied;
-                rq_rcv_buf->page_len = 0;
-        } else {
-                rq_rcv_buf->page_len = copied - rq_rcv_buf->head[0].iov_len;
-        }
        req->rq_private_buf.len = copied;
        set_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state);
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index f14f24ee9983..73ad57a59989 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -250,11 +250,11 @@ void rpc_destroy_wait_queue(struct rpc_wait_queue *queue)
 }
 EXPORT_SYMBOL_GPL(rpc_destroy_wait_queue);
-static int rpc_wait_bit_killable(struct wait_bit_key *key)
+static int rpc_wait_bit_killable(struct wait_bit_key *key, int mode)
 {
-        if (fatal_signal_pending(current))
-                return -ERESTARTSYS;
        freezable_schedule_unsafe();
+        if (signal_pending_state(mode, current))
+                return -ERESTARTSYS;
        return 0;
 }
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 7fccf9675df8..cc9852897395 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1363,7 +1363,19 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
        memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
        memcpy(&rqstp->rq_arg, &req->rq_rcv_buf, sizeof(rqstp->rq_arg));
        memcpy(&rqstp->rq_res, &req->rq_snd_buf, sizeof(rqstp->rq_res));
+        /* Adjust the argument buffer length */
        rqstp->rq_arg.len = req->rq_private_buf.len;
+        if (rqstp->rq_arg.len <= rqstp->rq_arg.head[0].iov_len) {
+                rqstp->rq_arg.head[0].iov_len = rqstp->rq_arg.len;
+                rqstp->rq_arg.page_len = 0;
+        } else if (rqstp->rq_arg.len <= rqstp->rq_arg.head[0].iov_len +
+                        rqstp->rq_arg.page_len)
+                rqstp->rq_arg.page_len = rqstp->rq_arg.len -
+                        rqstp->rq_arg.head[0].iov_len;
+        else
+                rqstp->rq_arg.len = rqstp->rq_arg.head[0].iov_len +
+                        rqstp->rq_arg.page_len;
        /* reset result send buffer "put" position */
        resv->iov_len = 0;
diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
index 1a10d8ac8162..dacf71a43ad4 100755
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -62,7 +62,7 @@ vmlinux_link()
                        -Wl,--start-group                                    \
                                 ${KBUILD_VMLINUX_MAIN}                      \
                        -Wl,--end-group                                      \
-                        -lutil ${1}
+                        -lutil -lrt ${1}
                rm -f linux
        fi
 }
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 963f82430938..bff5c8b329d1 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -355,6 +355,8 @@ enum {
                                        ((pci)->device == 0x0d0c) || \
                                        ((pci)->device == 0x160c))
+#define IS_BROXTON(pci) ((pci)->device == 0x5a98)
 static char *driver_short_names[] = {
        [AZX_DRIVER_ICH] = "HDA Intel",
        [AZX_DRIVER_PCH] = "HDA Intel PCH",
@@ -506,15 +508,36 @@ static void azx_init_pci(struct azx *chip)
        }
 }
+/*
+ * In BXT-P A0, HD-Audio DMA requests is later than expected,
+ * and makes an audio stream sensitive to system latencies when
+ * 24/32 bits are playing.
+ * Adjusting threshold of DMA fifo to force the DMA request
+ * sooner to improve latency tolerance at the expense of power.
+ */
+static void bxt_reduce_dma_latency(struct azx *chip)
+{
+        u32 val;
+        val = azx_readl(chip, SKL_EM4L);
+        val &= (0x3 << 20);
+        azx_writel(chip, SKL_EM4L, val);
+}
 static void hda_intel_init_chip(struct azx *chip, bool full_reset)
 {
        struct hdac_bus *bus = azx_bus(chip);
+        struct pci_dev *pci = chip->pci;
        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
                snd_hdac_set_codec_wakeup(bus, true);
        azx_init_chip(chip, full_reset);
        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
                snd_hdac_set_codec_wakeup(bus, false);
+        /* reduce dma latency to avoid noise */
+        if (IS_BROXTON(pci))
+                bxt_reduce_dma_latency(chip);
 }
 /* calculate runtime delay from LPIB */
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index f8a12ca477f1..4ef2259f88ca 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -778,7 +778,8 @@ static const struct hda_pintbl alienware_pincfgs[] = {
 };
 static const struct snd_pci_quirk ca0132_quirks[] = {
-        SND_PCI_QUIRK(0x1028, 0x0685, "Alienware 15", QUIRK_ALIENWARE),
+        SND_PCI_QUIRK(0x1028, 0x0685, "Alienware 15 2015", QUIRK_ALIENWARE),
+        SND_PCI_QUIRK(0x1028, 0x0688, "Alienware 17 2015", QUIRK_ALIENWARE),
        {}
 };
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 9bedf7c85e29..8dd2ac13b3af 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4204,6 +4204,18 @@ static void alc_fixup_tpt440_dock(struct hda_codec *codec,
        }
 }
+/* additional fixup for Thinkpad T440s noise problem */
+static void alc_fixup_tpt440(struct hda_codec *codec,
+                                  const struct hda_fixup *fix, int action)
+{
+        struct alc_spec *spec = codec->spec;
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                spec->shutup = alc_no_shutup; /* reduce click noise */
+                spec->gen.mixer_nid = 0; /* reduce background noise */
+        }
+}
 static void alc_shutup_dell_xps13(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
@@ -4578,6 +4590,7 @@ enum {
        ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC,
        ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
        ALC292_FIXUP_TPT440_DOCK,
+        ALC292_FIXUP_TPT440,
        ALC283_FIXUP_BXBT2807_MIC,
        ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED,
        ALC282_FIXUP_ASPIRE_V5_PINS,
@@ -4596,6 +4609,7 @@ enum {
        ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
        ALC275_FIXUP_DELL_XPS,
        ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE,
+        ALC293_FIXUP_LENOVO_SPK_NOISE,
 };
 static const struct hda_fixup alc269_fixups[] = {
@@ -5050,6 +5064,12 @@ static const struct hda_fixup alc269_fixups[] = {
                .chained = true,
                .chain_id = ALC269_FIXUP_LIMIT_INT_MIC_BOOST
        },
+        [ALC292_FIXUP_TPT440] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_tpt440,
+                .chained = true,
+                .chain_id = ALC292_FIXUP_TPT440_DOCK,
+        },
        [ALC283_FIXUP_BXBT2807_MIC] = {
                .type = HDA_FIXUP_PINS,
                .v.pins = (const struct hda_pintbl[]) {
@@ -5187,6 +5207,12 @@ static const struct hda_fixup alc269_fixups[] = {
                .chained = true,
                .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
        },
+        [ALC293_FIXUP_LENOVO_SPK_NOISE] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_disable_aamix,
+                .chained = true,
+                .chain_id = ALC269_FIXUP_THINKPAD_ACPI
+        },
 };
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -5325,7 +5351,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x2203, "Thinkpad X230 Tablet", ALC269_FIXUP_LENOVO_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x2208, "Thinkpad T431s", ALC269_FIXUP_LENOVO_DOCK),
-        SND_PCI_QUIRK(0x17aa, 0x220c, "Thinkpad T440s", ALC292_FIXUP_TPT440_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x220c, "Thinkpad T440s", ALC292_FIXUP_TPT440),
        SND_PCI_QUIRK(0x17aa, 0x220e, "Thinkpad T440p", ALC292_FIXUP_TPT440_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x2210, "Thinkpad T540p", ALC292_FIXUP_TPT440_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x2211, "Thinkpad W541", ALC292_FIXUP_TPT440_DOCK),
@@ -5334,6 +5360,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
        SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
        SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
        SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
        SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
@@ -5343,6 +5370,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x17aa, 0x5034, "Thinkpad T450", ALC292_FIXUP_TPT440_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
        SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
        SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
        SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
@@ -5423,6 +5451,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
        {.id = ALC283_FIXUP_CHROME_BOOK, .name = "alc283-dac-wcaps"},
        {.id = ALC283_FIXUP_SENSE_COMBO_JACK, .name = "alc283-sense-combo"},
        {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"},
+        {.id = ALC292_FIXUP_TPT440, .name = "tpt440"},
        {}
 };
@@ -6409,6 +6438,7 @@ static const struct hda_fixup alc662_fixups[] = {
 static const struct snd_pci_quirk alc662_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1019, 0x9087, "ECS", ALC662_FIXUP_ASUS_MODE2),
        SND_PCI_QUIRK(0x1025, 0x022f, "Acer Aspire One", ALC662_FIXUP_INV_DMIC),
+        SND_PCI_QUIRK(0x1025, 0x0241, "Packard Bell DOTS", ALC662_FIXUP_INV_DMIC),
        SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
        SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE),
        SND_PCI_QUIRK(0x1025, 0x0349, "eMachines eM250", ALC662_FIXUP_INV_DMIC),
diff --git a/sound/pci/rme96.c b/sound/pci/rme96.c
index 714df906249e..41c31db65039 100644
--- a/sound/pci/rme96.c
+++ b/sound/pci/rme96.c
@@ -741,10 +741,11 @@ snd_rme96_playback_setrate(struct rme96 *rme96,
        {
                /* change to/from double-speed: reset the DAC (if available) */
                snd_rme96_reset_dac(rme96);
+                return 1; /* need to restore volume */
        } else {
                writel(rme96->wcreg, rme96->iobase + RME96_IO_CONTROL_REGISTER);
+                return 0;
        }
-        return 0;
 }
 static int
@@ -980,6 +981,7 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream,
        struct rme96 *rme96 = snd_pcm_substream_chip(substream);
        struct snd_pcm_runtime *runtime = substream->runtime;
        int err, rate, dummy;
+        bool apply_dac_volume = false;
        runtime->dma_area = (void __force *)(rme96->iobase +
                                             RME96_IO_PLAY_BUFFER);
@@ -993,24 +995,26 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream,
        {
                /* slave clock */
                if ((int)params_rate(params) != rate) {
-                        spin_unlock_irq(&rme96->lock);
+                        err = -EIO;
-                        return -EIO;                    
+                        goto error;
-                }
+                }
-        } else if ((err = snd_rme96_playback_setrate(rme96, params_rate(params))) < 0) {
+        } else {
-                spin_unlock_irq(&rme96->lock);
+                err = snd_rme96_playback_setrate(rme96, params_rate(params));
-                return err;
+                if (err < 0)
-        }
+                        goto error;
-        if ((err = snd_rme96_playback_setformat(rme96, params_format(params))) < 0) {
+                apply_dac_volume = err > 0; /* need to restore volume later? */
-                spin_unlock_irq(&rme96->lock);
-                return err;
        }
+        err = snd_rme96_playback_setformat(rme96, params_format(params));
+        if (err < 0)
+                goto error;
        snd_rme96_setframelog(rme96, params_channels(params), 1);
        if (rme96->capture_periodsize != 0) {
                if (params_period_size(params) << rme96->playback_frlog !=
                    rme96->capture_periodsize)
                {
-                        spin_unlock_irq(&rme96->lock);
+                        err = -EBUSY;
-                        return -EBUSY;
+                        goto error;
                }
        }
        rme96->playback_periodsize =
@@ -1021,9 +1025,16 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream,
                rme96->wcreg &= ~(RME96_WCR_PRO | RME96_WCR_DOLBY | RME96_WCR_EMP);
                writel(rme96->wcreg |= rme96->wcreg_spdif_stream, rme96->iobase + RME96_IO_CONTROL_REGISTER);
        }
+        err = 0;
+ error:
        spin_unlock_irq(&rme96->lock);
-                
+        if (apply_dac_volume) {
-        return 0;
+                usleep_range(3000, 10000);
+                snd_rme96_apply_dac_volume(rme96);
+        }
+        return err;
 }
 static int
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
index 51cf8256c6cd..90bd2ea41032 100644
--- a/tools/testing/nvdimm/test/nfit.c
+++ b/tools/testing/nvdimm/test/nfit.c
@@ -248,6 +248,8 @@ static int nfit_test_cmd_ars_status(struct nd_cmd_ars_status *nd_cmd,
        nd_cmd->out_length = 256;
        nd_cmd->num_records = 0;
+        nd_cmd->address = 0;
+        nd_cmd->length = -1ULL;
        nd_cmd->status = 0;
        return 0;
@@ -1088,6 +1090,8 @@ static void nfit_test1_setup(struct nfit_test *t)
        struct acpi_nfit_memory_map *memdev;
        struct acpi_nfit_control_region *dcr;
        struct acpi_nfit_system_address *spa;
+        struct nvdimm_bus_descriptor *nd_desc;
+        struct acpi_nfit_desc *acpi_desc;
        offset = 0;
        /* spa0 (flat range with no bdw aliasing) */
@@ -1135,6 +1139,13 @@ static void nfit_test1_setup(struct nfit_test *t)
        dcr->command_size = 0;
        dcr->status_offset = 0;
        dcr->status_size = 0;
+        acpi_desc = &t->acpi_desc;
+        set_bit(ND_CMD_ARS_CAP, &acpi_desc->bus_dsm_force_en);
+        set_bit(ND_CMD_ARS_START, &acpi_desc->bus_dsm_force_en);
+        set_bit(ND_CMD_ARS_STATUS, &acpi_desc->bus_dsm_force_en);
+        nd_desc = &acpi_desc->nd_desc;
+        nd_desc->ndctl = nfit_test_ctl;
 }
 static int nfit_test_blk_do_io(struct nd_blk_region *ndbr, resource_size_t dpa,
diff --git a/tools/virtio/linux/kernel.h b/tools/virtio/linux/kernel.h
index 0a3da64638ce..4db7d5691ba7 100644
--- a/tools/virtio/linux/kernel.h
+++ b/tools/virtio/linux/kernel.h
@@ -110,4 +110,10 @@ static inline void free_page(unsigned long addr)
        (void) (&_min1 == &_min2);              \
        _min1 < _min2 ? _min1 : _min2; })
+/* TODO: empty stubs for now. Broken but enough for virtio_ring.c */
+#define list_add_tail(a, b) do {} while (0)
+#define list_del(a) do {} while (0)
+#define list_for_each_entry(a, b, c) while (0)
+/* end of stubs */
 #endif /* KERNEL_H */
diff --git a/tools/virtio/linux/virtio.h b/tools/virtio/linux/virtio.h
index a3e07016a440..ee125e714053 100644
--- a/tools/virtio/linux/virtio.h
+++ b/tools/virtio/linux/virtio.h
@@ -3,12 +3,6 @@
 #include <linux/scatterlist.h>
 #include <linux/kernel.h>
-/* TODO: empty stubs for now. Broken but enough for virtio_ring.c */
-#define list_add_tail(a, b) do {} while (0)
-#define list_del(a) do {} while (0)
-#define list_for_each_entry(a, b, c) while (0)
-/* end of stubs */
 struct virtio_device {
        void *dev;
        u64 features;
diff --git a/tools/virtio/linux/virtio_config.h b/tools/virtio/linux/virtio_config.h
index 806d683ab107..57a6964a1e35 100644
--- a/tools/virtio/linux/virtio_config.h
+++ b/tools/virtio/linux/virtio_config.h
@@ -40,33 +40,39 @@ static inline void __virtio_clear_bit(struct virtio_device *vdev,
 #define virtio_has_feature(dev, feature) \
        (__virtio_test_bit((dev), feature))
+static inline bool virtio_is_little_endian(struct virtio_device *vdev)
+{
+        return virtio_has_feature(vdev, VIRTIO_F_VERSION_1) ||
+                virtio_legacy_is_little_endian();
+}
+/* Memory accessors */
 static inline u16 virtio16_to_cpu(struct virtio_device *vdev, __virtio16 val)
 {
-        return __virtio16_to_cpu(virtio_has_feature(vdev, VIRTIO_F_VERSION_1), val);
+        return __virtio16_to_cpu(virtio_is_little_endian(vdev), val);
 }
 static inline __virtio16 cpu_to_virtio16(struct virtio_device *vdev, u16 val)
 {
-        return __cpu_to_virtio16(virtio_has_feature(vdev, VIRTIO_F_VERSION_1), val);
+        return __cpu_to_virtio16(virtio_is_little_endian(vdev), val);
 }
 static inline u32 virtio32_to_cpu(struct virtio_device *vdev, __virtio32 val)
 {
-        return __virtio32_to_cpu(virtio_has_feature(vdev, VIRTIO_F_VERSION_1), val);
+        return __virtio32_to_cpu(virtio_is_little_endian(vdev), val);
 }
 static inline __virtio32 cpu_to_virtio32(struct virtio_device *vdev, u32 val)
 {
-        return __cpu_to_virtio32(virtio_has_feature(vdev, VIRTIO_F_VERSION_1), val);
+        return __cpu_to_virtio32(virtio_is_little_endian(vdev), val);
 }
 static inline u64 virtio64_to_cpu(struct virtio_device *vdev, __virtio64 val)
 {
-        return __virtio64_to_cpu(virtio_has_feature(vdev, VIRTIO_F_VERSION_1), val);
+        return __virtio64_to_cpu(virtio_is_little_endian(vdev), val);
 }
 static inline __virtio64 cpu_to_virtio64(struct virtio_device *vdev, u64 val)
 {
-        return __cpu_to_virtio64(virtio_has_feature(vdev, VIRTIO_F_VERSION_1), val);
+        return __cpu_to_virtio64(virtio_is_little_endian(vdev), val);
 }
author	Dan Williams <dan.j.williams@intel.com>	2016-01-10 10:53:55 -0500
committer	Dan Williams <dan.j.williams@intel.com>	2016-01-10 10:53:55 -0500
commit	8b63b6bfc1a551acf154061699028c7032d7890c (patch)
tree	16882e9bc9e35eacb870a6d8a71617e579c4ffdc
parent	e07ecd76d4db7bda1e9495395b2110a3fe28845a (diff)
parent	55f5560d8c18fe33fc169f8d244a9247dcac7612 (diff)